xmrig | b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405

Analysis

max time kernel
95s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
Size

1.5MB
MD5

63bcbffdf7e50254919a1e70c12d7748
SHA1

6432de6be59678fabe6b946666a76fc805635e0a
SHA256

b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405
SHA512

7462113b3e1d2cbc35c4b659dbf0953b419cfd18a834652dd6d88bb995074fe13bab688c44774e4fb4b010af61c5997760771b6ecf1d404d07205306188eb5d4
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcB:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5v

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b8f-4.dat	xmrig
behavioral2/files/0x000a000000023b97-14.dat	xmrig
behavioral2/files/0x000b000000023b92-15.dat	xmrig
behavioral2/files/0x000a000000023b99-24.dat	xmrig
behavioral2/files/0x000a000000023b9c-31.dat	xmrig
behavioral2/files/0x000a000000023b9b-36.dat	xmrig
behavioral2/files/0x000a000000023b9a-33.dat	xmrig
behavioral2/files/0x000a000000023b98-32.dat	xmrig
behavioral2/files/0x000a000000023b9d-44.dat	xmrig
behavioral2/files/0x000a000000023b9f-47.dat	xmrig
behavioral2/files/0x000a000000023ba0-63.dat	xmrig
behavioral2/files/0x000a000000023ba1-64.dat	xmrig
behavioral2/files/0x000a000000023ba2-62.dat	xmrig
behavioral2/files/0x000b000000023b93-56.dat	xmrig
behavioral2/files/0x000b000000023ba4-78.dat	xmrig
behavioral2/files/0x0009000000023bc2-102.dat	xmrig
behavioral2/files/0x0008000000023bbd-113.dat	xmrig
behavioral2/files/0x0009000000023bc4-119.dat	xmrig
behavioral2/files/0x0009000000023bc3-117.dat	xmrig
behavioral2/files/0x000e000000023bc8-111.dat	xmrig
behavioral2/files/0x000e000000023bb4-109.dat	xmrig
behavioral2/files/0x000a000000023bad-104.dat	xmrig
behavioral2/files/0x000b000000023ba5-98.dat	xmrig
behavioral2/files/0x000b000000023ba3-85.dat	xmrig
behavioral2/files/0x0002000000022efc-127.dat	xmrig
behavioral2/files/0x0002000000022ef8-126.dat	xmrig
behavioral2/files/0x0010000000023a32-146.dat	xmrig
behavioral2/files/0x000e000000023a2d-151.dat	xmrig
behavioral2/files/0x0008000000023bcd-161.dat	xmrig
behavioral2/files/0x0008000000023bce-158.dat	xmrig
behavioral2/files/0x0008000000023bca-153.dat	xmrig
behavioral2/files/0x0013000000023a24-141.dat	xmrig
behavioral2/files/0x0011000000023a14-138.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4924	DstZfaO.exe
1932	vFmNePA.exe
1472	zavbAsg.exe
1616	QRCUSYQ.exe
3008	FvBGLSW.exe
4684	spUSFmZ.exe
1832	axjqzXJ.exe
1964	rZpwurr.exe
4896	WNCjorU.exe
704	NxXASIB.exe
1120	PqUROaI.exe
3344	dxjLWLQ.exe
3588	AKpuGGk.exe
3956	BeZvlkn.exe
4504	BWlEdxk.exe
212	AnlkEgq.exe
2372	QkuMPhF.exe
1256	HOqrBqn.exe
1612	faynkne.exe
4064	DTVqtJM.exe
756	NCKDiYi.exe
3928	srxehNd.exe
3768	paIobUs.exe
3644	IiiSFkB.exe
4408	uBYxtJb.exe
1668	wSjFjAY.exe
4380	rlJMOjg.exe
4308	ktjXIhk.exe
3656	dbDMeuL.exe
1524	jSBynWe.exe
4952	UkajVWN.exe
3452	HYecQKJ.exe
4052	CLhbUaZ.exe
1444	zfDiOTF.exe
1732	fcThqwe.exe
3524	mZAdYcB.exe
3952	VftxTqW.exe
2092	SyBvehX.exe
4284	kWuWRNj.exe
2100	yykJHBE.exe
4136	mtsFbXI.exe
1436	eKIIepK.exe
1872	HkZAPeP.exe
1084	LwHRcfl.exe
3184	URjfcvL.exe
4124	iKANcmu.exe
1628	ZPxFGws.exe
4460	AFyFYEM.exe
3636	XPnMOKl.exe
2404	kFbhwMU.exe
2940	AiywNqX.exe
2204	OYAwocB.exe
1400	wOmAMMw.exe
4384	mkgecol.exe
3984	GvDSBqs.exe
404	AVmnETu.exe
3096	BTmdoXn.exe
3180	FNnqQOI.exe
4840	jIRoUMa.exe
4820	jIykWiu.exe
536	lssRmHv.exe
3860	NFaRmuy.exe
4904	dyAfsGy.exe
2468	TovQFsj.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IoxrKLa.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\fWbscBE.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\DTzuxTL.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\eKIIepK.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\mbTZHFj.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\VUnlasJ.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\PbsQvMv.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\jIBtcPZ.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\VDKLdsj.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\ovFCKdW.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\IFKkfzg.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\RKgkPdp.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\OaSyYeM.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\YaVsTbl.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\wnfSmLc.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\jyUMAkq.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\UkajVWN.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\avHwFpf.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\FSDGxxT.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\zAWwKey.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\MfDIrQV.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\RpZtlNq.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\DqvqYsd.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\KSUNdhP.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\ZlSxCcX.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\OJwoJto.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\VKbitXj.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\FWXOAfq.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\KMHPyqf.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\clzndRB.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\mtsFbXI.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\RZSoVOW.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\ctdTZbg.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\DDZUfGn.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\VBTnnAS.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\tyJGoCM.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\WrlYqYp.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\eXbfBmf.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\TeljkGJ.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\NlFVOxa.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\FUDHnMD.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\FEIcySY.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\BmDhkdz.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\XAYCIJF.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\ibJVYeW.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\YbtDzJp.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\AcHHvgO.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\qrxfknh.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\lskVdQl.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\MfSdMIt.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\QRZYdzF.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\tjWMUkO.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\nAdoCoq.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\njfdPzZ.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\FyATcBF.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\auwkHwE.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\ELDaUCZ.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\MbCbbAI.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\SWsazgg.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\bqeLmWe.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\QOFscdw.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\weZxRHb.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\gSlnaGl.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
File created	C:\Windows\System\bRiOuDD.exe	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4924	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	86
PID 720 wrote to memory of 4924	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	86
PID 720 wrote to memory of 1932	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	87
PID 720 wrote to memory of 1932	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	87
PID 720 wrote to memory of 1472	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	88
PID 720 wrote to memory of 1472	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	88
PID 720 wrote to memory of 1616	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	89
PID 720 wrote to memory of 1616	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	89
PID 720 wrote to memory of 3008	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	90
PID 720 wrote to memory of 3008	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	90
PID 720 wrote to memory of 4684	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	91
PID 720 wrote to memory of 4684	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	91
PID 720 wrote to memory of 1832	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	92
PID 720 wrote to memory of 1832	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	92
PID 720 wrote to memory of 1964	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	93
PID 720 wrote to memory of 1964	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	93
PID 720 wrote to memory of 4896	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	94
PID 720 wrote to memory of 4896	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	94
PID 720 wrote to memory of 704	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	95
PID 720 wrote to memory of 704	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	95
PID 720 wrote to memory of 1120	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	96
PID 720 wrote to memory of 1120	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	96
PID 720 wrote to memory of 3956	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	97
PID 720 wrote to memory of 3956	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	97
PID 720 wrote to memory of 3344	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	98
PID 720 wrote to memory of 3344	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	98
PID 720 wrote to memory of 3588	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	99
PID 720 wrote to memory of 3588	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	99
PID 720 wrote to memory of 4504	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	101
PID 720 wrote to memory of 4504	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	101
PID 720 wrote to memory of 212	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	102
PID 720 wrote to memory of 212	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	102
PID 720 wrote to memory of 2372	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	103
PID 720 wrote to memory of 2372	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	103
PID 720 wrote to memory of 1256	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	104
PID 720 wrote to memory of 1256	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	104
PID 720 wrote to memory of 3768	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	105
PID 720 wrote to memory of 3768	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	105
PID 720 wrote to memory of 1612	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	106
PID 720 wrote to memory of 1612	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	106
PID 720 wrote to memory of 4064	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	107
PID 720 wrote to memory of 4064	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	107
PID 720 wrote to memory of 756	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	108
PID 720 wrote to memory of 756	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	108
PID 720 wrote to memory of 3928	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	109
PID 720 wrote to memory of 3928	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	109
PID 720 wrote to memory of 3644	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	110
PID 720 wrote to memory of 3644	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	110
PID 720 wrote to memory of 4408	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	113
PID 720 wrote to memory of 4408	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	113
PID 720 wrote to memory of 1668	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	114
PID 720 wrote to memory of 1668	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	114
PID 720 wrote to memory of 4380	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	115
PID 720 wrote to memory of 4380	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	115
PID 720 wrote to memory of 4308	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	117
PID 720 wrote to memory of 4308	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	117
PID 720 wrote to memory of 3656	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	118
PID 720 wrote to memory of 3656	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	118
PID 720 wrote to memory of 1524	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	119
PID 720 wrote to memory of 1524	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	119
PID 720 wrote to memory of 4952	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	121
PID 720 wrote to memory of 4952	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	121
PID 720 wrote to memory of 3452	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	122
PID 720 wrote to memory of 3452	720	b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe	122

C:\Users\Admin\AppData\Local\Temp\b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe
"C:\Users\Admin\AppData\Local\Temp\b6cd8cbf417a1fc225e48b7887f5fb4faf009b9cd8c5b548abf10c73e0797405.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\System\DstZfaO.exe
  C:\Windows\System\DstZfaO.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\vFmNePA.exe
  C:\Windows\System\vFmNePA.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\zavbAsg.exe
  C:\Windows\System\zavbAsg.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\QRCUSYQ.exe
  C:\Windows\System\QRCUSYQ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\FvBGLSW.exe
  C:\Windows\System\FvBGLSW.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\spUSFmZ.exe
  C:\Windows\System\spUSFmZ.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\axjqzXJ.exe
  C:\Windows\System\axjqzXJ.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\rZpwurr.exe
  C:\Windows\System\rZpwurr.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\WNCjorU.exe
  C:\Windows\System\WNCjorU.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\NxXASIB.exe
  C:\Windows\System\NxXASIB.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\PqUROaI.exe
  C:\Windows\System\PqUROaI.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\BeZvlkn.exe
  C:\Windows\System\BeZvlkn.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\dxjLWLQ.exe
  C:\Windows\System\dxjLWLQ.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\AKpuGGk.exe
  C:\Windows\System\AKpuGGk.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\BWlEdxk.exe
  C:\Windows\System\BWlEdxk.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\AnlkEgq.exe
  C:\Windows\System\AnlkEgq.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\QkuMPhF.exe
  C:\Windows\System\QkuMPhF.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\HOqrBqn.exe
  C:\Windows\System\HOqrBqn.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\paIobUs.exe
  C:\Windows\System\paIobUs.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\faynkne.exe
  C:\Windows\System\faynkne.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\DTVqtJM.exe
  C:\Windows\System\DTVqtJM.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\NCKDiYi.exe
  C:\Windows\System\NCKDiYi.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\srxehNd.exe
  C:\Windows\System\srxehNd.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\IiiSFkB.exe
  C:\Windows\System\IiiSFkB.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\uBYxtJb.exe
  C:\Windows\System\uBYxtJb.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\wSjFjAY.exe
  C:\Windows\System\wSjFjAY.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\rlJMOjg.exe
  C:\Windows\System\rlJMOjg.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\ktjXIhk.exe
  C:\Windows\System\ktjXIhk.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\dbDMeuL.exe
  C:\Windows\System\dbDMeuL.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\jSBynWe.exe
  C:\Windows\System\jSBynWe.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\UkajVWN.exe
  C:\Windows\System\UkajVWN.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\HYecQKJ.exe
  C:\Windows\System\HYecQKJ.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\CLhbUaZ.exe
  C:\Windows\System\CLhbUaZ.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\zfDiOTF.exe
  C:\Windows\System\zfDiOTF.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\fcThqwe.exe
  C:\Windows\System\fcThqwe.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\mZAdYcB.exe
  C:\Windows\System\mZAdYcB.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\VftxTqW.exe
  C:\Windows\System\VftxTqW.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\SyBvehX.exe
  C:\Windows\System\SyBvehX.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\kWuWRNj.exe
  C:\Windows\System\kWuWRNj.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\yykJHBE.exe
  C:\Windows\System\yykJHBE.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\mtsFbXI.exe
  C:\Windows\System\mtsFbXI.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\eKIIepK.exe
  C:\Windows\System\eKIIepK.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\HkZAPeP.exe
  C:\Windows\System\HkZAPeP.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\LwHRcfl.exe
  C:\Windows\System\LwHRcfl.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\URjfcvL.exe
  C:\Windows\System\URjfcvL.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\iKANcmu.exe
  C:\Windows\System\iKANcmu.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\ZPxFGws.exe
  C:\Windows\System\ZPxFGws.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\AFyFYEM.exe
  C:\Windows\System\AFyFYEM.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\XPnMOKl.exe
  C:\Windows\System\XPnMOKl.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\kFbhwMU.exe
  C:\Windows\System\kFbhwMU.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\AiywNqX.exe
  C:\Windows\System\AiywNqX.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\OYAwocB.exe
  C:\Windows\System\OYAwocB.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\wOmAMMw.exe
  C:\Windows\System\wOmAMMw.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\mkgecol.exe
  C:\Windows\System\mkgecol.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\GvDSBqs.exe
  C:\Windows\System\GvDSBqs.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\AVmnETu.exe
  C:\Windows\System\AVmnETu.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\BTmdoXn.exe
  C:\Windows\System\BTmdoXn.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\FNnqQOI.exe
  C:\Windows\System\FNnqQOI.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\jIRoUMa.exe
  C:\Windows\System\jIRoUMa.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\jIykWiu.exe
  C:\Windows\System\jIykWiu.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\lssRmHv.exe
  C:\Windows\System\lssRmHv.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\NFaRmuy.exe
  C:\Windows\System\NFaRmuy.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\dyAfsGy.exe
  C:\Windows\System\dyAfsGy.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\TovQFsj.exe
  C:\Windows\System\TovQFsj.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\SYtilyE.exe
  C:\Windows\System\SYtilyE.exe
  2⤵
  PID:1072
- C:\Windows\System\qMnybvw.exe
  C:\Windows\System\qMnybvw.exe
  2⤵
  PID:4552
- C:\Windows\System\XyaRuEK.exe
  C:\Windows\System\XyaRuEK.exe
  2⤵
  PID:3116
- C:\Windows\System\doUAOKd.exe
  C:\Windows\System\doUAOKd.exe
  2⤵
  PID:1560
- C:\Windows\System\sVLeQkL.exe
  C:\Windows\System\sVLeQkL.exe
  2⤵
  PID:4548
- C:\Windows\System\ssWquOt.exe
  C:\Windows\System\ssWquOt.exe
  2⤵
  PID:3888
- C:\Windows\System\ytNShAL.exe
  C:\Windows\System\ytNShAL.exe
  2⤵
  PID:1728
- C:\Windows\System\iNYZChI.exe
  C:\Windows\System\iNYZChI.exe
  2⤵
  PID:4216
- C:\Windows\System\baPQijA.exe
  C:\Windows\System\baPQijA.exe
  2⤵
  PID:4244
- C:\Windows\System\jURDZBW.exe
  C:\Windows\System\jURDZBW.exe
  2⤵
  PID:4828
- C:\Windows\System\GXoLlke.exe
  C:\Windows\System\GXoLlke.exe
  2⤵
  PID:4972
- C:\Windows\System\kTtoYwO.exe
  C:\Windows\System\kTtoYwO.exe
  2⤵
  PID:5044
- C:\Windows\System\ecWJrHJ.exe
  C:\Windows\System\ecWJrHJ.exe
  2⤵
  PID:3128
- C:\Windows\System\pJEhCeM.exe
  C:\Windows\System\pJEhCeM.exe
  2⤵
  PID:3508
- C:\Windows\System\RkcdEsR.exe
  C:\Windows\System\RkcdEsR.exe
  2⤵
  PID:4092
- C:\Windows\System\tkPjavJ.exe
  C:\Windows\System\tkPjavJ.exe
  2⤵
  PID:400
- C:\Windows\System\NMngqkH.exe
  C:\Windows\System\NMngqkH.exe
  2⤵
  PID:4832
- C:\Windows\System\dhCXCnB.exe
  C:\Windows\System\dhCXCnB.exe
  2⤵
  PID:396
- C:\Windows\System\fjRPOeO.exe
  C:\Windows\System\fjRPOeO.exe
  2⤵
  PID:2476
- C:\Windows\System\TjsUtzp.exe
  C:\Windows\System\TjsUtzp.exe
  2⤵
  PID:5128
- C:\Windows\System\tQHcQzn.exe
  C:\Windows\System\tQHcQzn.exe
  2⤵
  PID:5156
- C:\Windows\System\adxpfsW.exe
  C:\Windows\System\adxpfsW.exe
  2⤵
  PID:5184
- C:\Windows\System\ubepUzs.exe
  C:\Windows\System\ubepUzs.exe
  2⤵
  PID:5212
- C:\Windows\System\TeljkGJ.exe
  C:\Windows\System\TeljkGJ.exe
  2⤵
  PID:5240
- C:\Windows\System\nXotYuQ.exe
  C:\Windows\System\nXotYuQ.exe
  2⤵
  PID:5260
- C:\Windows\System\HOuIhWM.exe
  C:\Windows\System\HOuIhWM.exe
  2⤵
  PID:5292
- C:\Windows\System\vPOqMCq.exe
  C:\Windows\System\vPOqMCq.exe
  2⤵
  PID:5312
- C:\Windows\System\dXuAwLo.exe
  C:\Windows\System\dXuAwLo.exe
  2⤵
  PID:5332
- C:\Windows\System\OWOZpKf.exe
  C:\Windows\System\OWOZpKf.exe
  2⤵
  PID:5360
- C:\Windows\System\fdYVvDc.exe
  C:\Windows\System\fdYVvDc.exe
  2⤵
  PID:5404
- C:\Windows\System\KauwVBe.exe
  C:\Windows\System\KauwVBe.exe
  2⤵
  PID:5436
- C:\Windows\System\mTDVcYK.exe
  C:\Windows\System\mTDVcYK.exe
  2⤵
  PID:5464
- C:\Windows\System\LAFXhkK.exe
  C:\Windows\System\LAFXhkK.exe
  2⤵
  PID:5504
- C:\Windows\System\LDeLrig.exe
  C:\Windows\System\LDeLrig.exe
  2⤵
  PID:5520
- C:\Windows\System\FiIXMnL.exe
  C:\Windows\System\FiIXMnL.exe
  2⤵
  PID:5552
- C:\Windows\System\UdIlucp.exe
  C:\Windows\System\UdIlucp.exe
  2⤵
  PID:5576
- C:\Windows\System\AlwcaxN.exe
  C:\Windows\System\AlwcaxN.exe
  2⤵
  PID:5616
- C:\Windows\System\SSsGxGG.exe
  C:\Windows\System\SSsGxGG.exe
  2⤵
  PID:5644
- C:\Windows\System\XkcjPeJ.exe
  C:\Windows\System\XkcjPeJ.exe
  2⤵
  PID:5688
- C:\Windows\System\jchqJqw.exe
  C:\Windows\System\jchqJqw.exe
  2⤵
  PID:5716
- C:\Windows\System\XdRPdjE.exe
  C:\Windows\System\XdRPdjE.exe
  2⤵
  PID:5740
- C:\Windows\System\oZziOaU.exe
  C:\Windows\System\oZziOaU.exe
  2⤵
  PID:5756
- C:\Windows\System\edKEXZW.exe
  C:\Windows\System\edKEXZW.exe
  2⤵
  PID:5780
- C:\Windows\System\xcyQXHp.exe
  C:\Windows\System\xcyQXHp.exe
  2⤵
  PID:5832
- C:\Windows\System\nKQKYOQ.exe
  C:\Windows\System\nKQKYOQ.exe
  2⤵
  PID:5864
- C:\Windows\System\mbTZHFj.exe
  C:\Windows\System\mbTZHFj.exe
  2⤵
  PID:5888
- C:\Windows\System\XWVBbVw.exe
  C:\Windows\System\XWVBbVw.exe
  2⤵
  PID:5924
- C:\Windows\System\hWVnvrR.exe
  C:\Windows\System\hWVnvrR.exe
  2⤵
  PID:5964
- C:\Windows\System\RoZXifq.exe
  C:\Windows\System\RoZXifq.exe
  2⤵
  PID:5980
- C:\Windows\System\ElmRLjm.exe
  C:\Windows\System\ElmRLjm.exe
  2⤵
  PID:6008
- C:\Windows\System\gxeHvjJ.exe
  C:\Windows\System\gxeHvjJ.exe
  2⤵
  PID:6040
- C:\Windows\System\rizEYiv.exe
  C:\Windows\System\rizEYiv.exe
  2⤵
  PID:6076
- C:\Windows\System\OXwUPjV.exe
  C:\Windows\System\OXwUPjV.exe
  2⤵
  PID:6100
- C:\Windows\System\QzWErJs.exe
  C:\Windows\System\QzWErJs.exe
  2⤵
  PID:6120
- C:\Windows\System\DWEqkQs.exe
  C:\Windows\System\DWEqkQs.exe
  2⤵
  PID:1960
- C:\Windows\System\dvkAxhV.exe
  C:\Windows\System\dvkAxhV.exe
  2⤵
  PID:5200
- C:\Windows\System\MbCbbAI.exe
  C:\Windows\System\MbCbbAI.exe
  2⤵
  PID:5268
- C:\Windows\System\gIzzLZW.exe
  C:\Windows\System\gIzzLZW.exe
  2⤵
  PID:5328
- C:\Windows\System\HmnorBZ.exe
  C:\Windows\System\HmnorBZ.exe
  2⤵
  PID:5376
- C:\Windows\System\MxECPzz.exe
  C:\Windows\System\MxECPzz.exe
  2⤵
  PID:5456
- C:\Windows\System\ZxSLgyT.exe
  C:\Windows\System\ZxSLgyT.exe
  2⤵
  PID:5516
- C:\Windows\System\kXAhuKx.exe
  C:\Windows\System\kXAhuKx.exe
  2⤵
  PID:5568
- C:\Windows\System\owqmdMC.exe
  C:\Windows\System\owqmdMC.exe
  2⤵
  PID:5636
- C:\Windows\System\rQxDuzS.exe
  C:\Windows\System\rQxDuzS.exe
  2⤵
  PID:5708
- C:\Windows\System\ICTOHJj.exe
  C:\Windows\System\ICTOHJj.exe
  2⤵
  PID:5796
- C:\Windows\System\kCkHPcb.exe
  C:\Windows\System\kCkHPcb.exe
  2⤵
  PID:5880
- C:\Windows\System\zcCgnli.exe
  C:\Windows\System\zcCgnli.exe
  2⤵
  PID:5936
- C:\Windows\System\gFFjyIM.exe
  C:\Windows\System\gFFjyIM.exe
  2⤵
  PID:5996
- C:\Windows\System\iaumQYo.exe
  C:\Windows\System\iaumQYo.exe
  2⤵
  PID:6084
- C:\Windows\System\ddXQvmW.exe
  C:\Windows\System\ddXQvmW.exe
  2⤵
  PID:5176
- C:\Windows\System\YmvsDVJ.exe
  C:\Windows\System\YmvsDVJ.exe
  2⤵
  PID:5304
- C:\Windows\System\hVTPoVQ.exe
  C:\Windows\System\hVTPoVQ.exe
  2⤵
  PID:5476
- C:\Windows\System\bUtcQfl.exe
  C:\Windows\System\bUtcQfl.exe
  2⤵
  PID:5596
- C:\Windows\System\pWdXSAe.exe
  C:\Windows\System\pWdXSAe.exe
  2⤵
  PID:5748
- C:\Windows\System\JcWyKUj.exe
  C:\Windows\System\JcWyKUj.exe
  2⤵
  PID:5904
- C:\Windows\System\VaAYLIe.exe
  C:\Windows\System\VaAYLIe.exe
  2⤵
  PID:668
- C:\Windows\System\fDOouIx.exe
  C:\Windows\System\fDOouIx.exe
  2⤵
  PID:6116
- C:\Windows\System\IBjrJle.exe
  C:\Windows\System\IBjrJle.exe
  2⤵
  PID:5496
- C:\Windows\System\nEOJkYj.exe
  C:\Windows\System\nEOJkYj.exe
  2⤵
  PID:5852
- C:\Windows\System\pUzWbHI.exe
  C:\Windows\System\pUzWbHI.exe
  2⤵
  PID:6112
- C:\Windows\System\QNTKYbG.exe
  C:\Windows\System\QNTKYbG.exe
  2⤵
  PID:5652
- C:\Windows\System\UvgnUpP.exe
  C:\Windows\System\UvgnUpP.exe
  2⤵
  PID:5348
- C:\Windows\System\dkIrjeL.exe
  C:\Windows\System\dkIrjeL.exe
  2⤵
  PID:6180
- C:\Windows\System\FRljrey.exe
  C:\Windows\System\FRljrey.exe
  2⤵
  PID:6212
- C:\Windows\System\TdFbRKd.exe
  C:\Windows\System\TdFbRKd.exe
  2⤵
  PID:6236
- C:\Windows\System\ptQivMr.exe
  C:\Windows\System\ptQivMr.exe
  2⤵
  PID:6252
- C:\Windows\System\ygLzjhs.exe
  C:\Windows\System\ygLzjhs.exe
  2⤵
  PID:6276
- C:\Windows\System\eKewMjH.exe
  C:\Windows\System\eKewMjH.exe
  2⤵
  PID:6304
- C:\Windows\System\dickjLy.exe
  C:\Windows\System\dickjLy.exe
  2⤵
  PID:6344
- C:\Windows\System\zdbLqOs.exe
  C:\Windows\System\zdbLqOs.exe
  2⤵
  PID:6384
- C:\Windows\System\HdNBlXL.exe
  C:\Windows\System\HdNBlXL.exe
  2⤵
  PID:6420
- C:\Windows\System\kGAotDB.exe
  C:\Windows\System\kGAotDB.exe
  2⤵
  PID:6456
- C:\Windows\System\ApeMPoW.exe
  C:\Windows\System\ApeMPoW.exe
  2⤵
  PID:6476
- C:\Windows\System\RiVeDfP.exe
  C:\Windows\System\RiVeDfP.exe
  2⤵
  PID:6496
- C:\Windows\System\WoOzBRx.exe
  C:\Windows\System\WoOzBRx.exe
  2⤵
  PID:6532
- C:\Windows\System\WGmPZMi.exe
  C:\Windows\System\WGmPZMi.exe
  2⤵
  PID:6556
- C:\Windows\System\hbBWlhX.exe
  C:\Windows\System\hbBWlhX.exe
  2⤵
  PID:6576
- C:\Windows\System\wruhqmX.exe
  C:\Windows\System\wruhqmX.exe
  2⤵
  PID:6600
- C:\Windows\System\vyvGLvT.exe
  C:\Windows\System\vyvGLvT.exe
  2⤵
  PID:6620
- C:\Windows\System\sDGXUfG.exe
  C:\Windows\System\sDGXUfG.exe
  2⤵
  PID:6644
- C:\Windows\System\jiciCSD.exe
  C:\Windows\System\jiciCSD.exe
  2⤵
  PID:6664
- C:\Windows\System\xPzDAEC.exe
  C:\Windows\System\xPzDAEC.exe
  2⤵
  PID:6692
- C:\Windows\System\QopaJSs.exe
  C:\Windows\System\QopaJSs.exe
  2⤵
  PID:6728
- C:\Windows\System\UenIipY.exe
  C:\Windows\System\UenIipY.exe
  2⤵
  PID:6756
- C:\Windows\System\yKyXYTN.exe
  C:\Windows\System\yKyXYTN.exe
  2⤵
  PID:6796
- C:\Windows\System\uQPnsiW.exe
  C:\Windows\System\uQPnsiW.exe
  2⤵
  PID:6852
- C:\Windows\System\xGMVxJx.exe
  C:\Windows\System\xGMVxJx.exe
  2⤵
  PID:6872
- C:\Windows\System\xiFpWLR.exe
  C:\Windows\System\xiFpWLR.exe
  2⤵
  PID:6904
- C:\Windows\System\OfCxSus.exe
  C:\Windows\System\OfCxSus.exe
  2⤵
  PID:6936
- C:\Windows\System\gOdHDca.exe
  C:\Windows\System\gOdHDca.exe
  2⤵
  PID:6964
- C:\Windows\System\qiBpVjV.exe
  C:\Windows\System\qiBpVjV.exe
  2⤵
  PID:6992
- C:\Windows\System\RmRFNMW.exe
  C:\Windows\System\RmRFNMW.exe
  2⤵
  PID:7032
- C:\Windows\System\xuLoLcr.exe
  C:\Windows\System\xuLoLcr.exe
  2⤵
  PID:7068
- C:\Windows\System\VxbyNUv.exe
  C:\Windows\System\VxbyNUv.exe
  2⤵
  PID:7084
- C:\Windows\System\YUjvLWW.exe
  C:\Windows\System\YUjvLWW.exe
  2⤵
  PID:7104
- C:\Windows\System\WRdeUQz.exe
  C:\Windows\System\WRdeUQz.exe
  2⤵
  PID:7124
- C:\Windows\System\IPXBODR.exe
  C:\Windows\System\IPXBODR.exe
  2⤵
  PID:7164
- C:\Windows\System\oEKIRHY.exe
  C:\Windows\System\oEKIRHY.exe
  2⤵
  PID:5432
- C:\Windows\System\DOvqrZE.exe
  C:\Windows\System\DOvqrZE.exe
  2⤵
  PID:6196
- C:\Windows\System\mAHxRwb.exe
  C:\Windows\System\mAHxRwb.exe
  2⤵
  PID:6248
- C:\Windows\System\qtuLSQX.exe
  C:\Windows\System\qtuLSQX.exe
  2⤵
  PID:6292
- C:\Windows\System\HYcRhxD.exe
  C:\Windows\System\HYcRhxD.exe
  2⤵
  PID:6340
- C:\Windows\System\vQnpxPc.exe
  C:\Windows\System\vQnpxPc.exe
  2⤵
  PID:6432
- C:\Windows\System\mnCfXwE.exe
  C:\Windows\System\mnCfXwE.exe
  2⤵
  PID:6504
- C:\Windows\System\QRUVhXB.exe
  C:\Windows\System\QRUVhXB.exe
  2⤵
  PID:6588
- C:\Windows\System\hftnvig.exe
  C:\Windows\System\hftnvig.exe
  2⤵
  PID:6656
- C:\Windows\System\NHfQbxn.exe
  C:\Windows\System\NHfQbxn.exe
  2⤵
  PID:6740
- C:\Windows\System\KuUUZPY.exe
  C:\Windows\System\KuUUZPY.exe
  2⤵
  PID:6860
- C:\Windows\System\wyksOsX.exe
  C:\Windows\System\wyksOsX.exe
  2⤵
  PID:6960
- C:\Windows\System\XTjleXF.exe
  C:\Windows\System\XTjleXF.exe
  2⤵
  PID:6900
- C:\Windows\System\zXXzFQC.exe
  C:\Windows\System\zXXzFQC.exe
  2⤵
  PID:7080
- C:\Windows\System\FDlwiFX.exe
  C:\Windows\System\FDlwiFX.exe
  2⤵
  PID:5492
- C:\Windows\System\pUfnJeP.exe
  C:\Windows\System\pUfnJeP.exe
  2⤵
  PID:7152
- C:\Windows\System\tMkVPZo.exe
  C:\Windows\System\tMkVPZo.exe
  2⤵
  PID:6324
- C:\Windows\System\UMzxRFN.exe
  C:\Windows\System\UMzxRFN.exe
  2⤵
  PID:6264
- C:\Windows\System\JcwKYHD.exe
  C:\Windows\System\JcwKYHD.exe
  2⤵
  PID:6884
- C:\Windows\System\WgVGnfD.exe
  C:\Windows\System\WgVGnfD.exe
  2⤵
  PID:6984
- C:\Windows\System\HlNDBUt.exe
  C:\Windows\System\HlNDBUt.exe
  2⤵
  PID:6680
- C:\Windows\System\INcBldj.exe
  C:\Windows\System\INcBldj.exe
  2⤵
  PID:6288
- C:\Windows\System\kHCvnnb.exe
  C:\Windows\System\kHCvnnb.exe
  2⤵
  PID:7172
- C:\Windows\System\khbEznk.exe
  C:\Windows\System\khbEznk.exe
  2⤵
  PID:7200
- C:\Windows\System\dLBDlgi.exe
  C:\Windows\System\dLBDlgi.exe
  2⤵
  PID:7228
- C:\Windows\System\kFfAYqL.exe
  C:\Windows\System\kFfAYqL.exe
  2⤵
  PID:7252
- C:\Windows\System\WfjDdJK.exe
  C:\Windows\System\WfjDdJK.exe
  2⤵
  PID:7284
- C:\Windows\System\xkmKbOq.exe
  C:\Windows\System\xkmKbOq.exe
  2⤵
  PID:7312
- C:\Windows\System\jsXINQM.exe
  C:\Windows\System\jsXINQM.exe
  2⤵
  PID:7344
- C:\Windows\System\vdXkyHc.exe
  C:\Windows\System\vdXkyHc.exe
  2⤵
  PID:7364
- C:\Windows\System\alAddSI.exe
  C:\Windows\System\alAddSI.exe
  2⤵
  PID:7388
- C:\Windows\System\tRZGsDT.exe
  C:\Windows\System\tRZGsDT.exe
  2⤵
  PID:7412
- C:\Windows\System\WTmygXi.exe
  C:\Windows\System\WTmygXi.exe
  2⤵
  PID:7440
- C:\Windows\System\VTmbSCx.exe
  C:\Windows\System\VTmbSCx.exe
  2⤵
  PID:7468
- C:\Windows\System\FdvRPZx.exe
  C:\Windows\System\FdvRPZx.exe
  2⤵
  PID:7492
- C:\Windows\System\KmHCvgx.exe
  C:\Windows\System\KmHCvgx.exe
  2⤵
  PID:7512
- C:\Windows\System\ixZQgPz.exe
  C:\Windows\System\ixZQgPz.exe
  2⤵
  PID:7540
- C:\Windows\System\DDZUfGn.exe
  C:\Windows\System\DDZUfGn.exe
  2⤵
  PID:7556
- C:\Windows\System\arBKxos.exe
  C:\Windows\System\arBKxos.exe
  2⤵
  PID:7580
- C:\Windows\System\VngfHng.exe
  C:\Windows\System\VngfHng.exe
  2⤵
  PID:7608
- C:\Windows\System\woeJsvk.exe
  C:\Windows\System\woeJsvk.exe
  2⤵
  PID:7636
- C:\Windows\System\wdVcBAN.exe
  C:\Windows\System\wdVcBAN.exe
  2⤵
  PID:7668
- C:\Windows\System\NlFVOxa.exe
  C:\Windows\System\NlFVOxa.exe
  2⤵
  PID:7696
- C:\Windows\System\CrYviyC.exe
  C:\Windows\System\CrYviyC.exe
  2⤵
  PID:7724
- C:\Windows\System\hyjbTMs.exe
  C:\Windows\System\hyjbTMs.exe
  2⤵
  PID:7756
- C:\Windows\System\hHGOhRO.exe
  C:\Windows\System\hHGOhRO.exe
  2⤵
  PID:7776
- C:\Windows\System\yOcbqaQ.exe
  C:\Windows\System\yOcbqaQ.exe
  2⤵
  PID:7808
- C:\Windows\System\WzdFREY.exe
  C:\Windows\System\WzdFREY.exe
  2⤵
  PID:7836
- C:\Windows\System\yvBgSZH.exe
  C:\Windows\System\yvBgSZH.exe
  2⤵
  PID:7868
- C:\Windows\System\PKRQfGM.exe
  C:\Windows\System\PKRQfGM.exe
  2⤵
  PID:7888
- C:\Windows\System\aPjXJtf.exe
  C:\Windows\System\aPjXJtf.exe
  2⤵
  PID:7916
- C:\Windows\System\vVdTmis.exe
  C:\Windows\System\vVdTmis.exe
  2⤵
  PID:7944
- C:\Windows\System\xaEawTe.exe
  C:\Windows\System\xaEawTe.exe
  2⤵
  PID:7964
- C:\Windows\System\VKbitXj.exe
  C:\Windows\System\VKbitXj.exe
  2⤵
  PID:8004
- C:\Windows\System\vVzJpuX.exe
  C:\Windows\System\vVzJpuX.exe
  2⤵
  PID:8032
- C:\Windows\System\JbepiAL.exe
  C:\Windows\System\JbepiAL.exe
  2⤵
  PID:8052
- C:\Windows\System\MDSFfva.exe
  C:\Windows\System\MDSFfva.exe
  2⤵
  PID:8092
- C:\Windows\System\kYUDXvn.exe
  C:\Windows\System\kYUDXvn.exe
  2⤵
  PID:8148
- C:\Windows\System\aBGswfh.exe
  C:\Windows\System\aBGswfh.exe
  2⤵
  PID:8176
- C:\Windows\System\zqAAYVG.exe
  C:\Windows\System\zqAAYVG.exe
  2⤵
  PID:6584
- C:\Windows\System\FQcnoWo.exe
  C:\Windows\System\FQcnoWo.exe
  2⤵
  PID:7272
- C:\Windows\System\cWlcdCC.exe
  C:\Windows\System\cWlcdCC.exe
  2⤵
  PID:6516
- C:\Windows\System\sdzXsdr.exe
  C:\Windows\System\sdzXsdr.exe
  2⤵
  PID:7196
- C:\Windows\System\qHoSKNI.exe
  C:\Windows\System\qHoSKNI.exe
  2⤵
  PID:7260
- C:\Windows\System\qrxfknh.exe
  C:\Windows\System\qrxfknh.exe
  2⤵
  PID:7576
- C:\Windows\System\Asivqim.exe
  C:\Windows\System\Asivqim.exe
  2⤵
  PID:7536
- C:\Windows\System\sWqvaJJ.exe
  C:\Windows\System\sWqvaJJ.exe
  2⤵
  PID:7688
- C:\Windows\System\tEgyltq.exe
  C:\Windows\System\tEgyltq.exe
  2⤵
  PID:7484
- C:\Windows\System\bTDoFoU.exe
  C:\Windows\System\bTDoFoU.exe
  2⤵
  PID:7616
- C:\Windows\System\kFjflOZ.exe
  C:\Windows\System\kFjflOZ.exe
  2⤵
  PID:7772
- C:\Windows\System\XiifXsb.exe
  C:\Windows\System\XiifXsb.exe
  2⤵
  PID:7828
- C:\Windows\System\fisowFH.exe
  C:\Windows\System\fisowFH.exe
  2⤵
  PID:7848
- C:\Windows\System\TkWoLJl.exe
  C:\Windows\System\TkWoLJl.exe
  2⤵
  PID:7880
- C:\Windows\System\sBUhVxu.exe
  C:\Windows\System\sBUhVxu.exe
  2⤵
  PID:8020
- C:\Windows\System\ixNoOOZ.exe
  C:\Windows\System\ixNoOOZ.exe
  2⤵
  PID:7852
- C:\Windows\System\VztUVuI.exe
  C:\Windows\System\VztUVuI.exe
  2⤵
  PID:8068
- C:\Windows\System\ZpzzKga.exe
  C:\Windows\System\ZpzzKga.exe
  2⤵
  PID:8188
- C:\Windows\System\zBZTqRx.exe
  C:\Windows\System\zBZTqRx.exe
  2⤵
  PID:7300
- C:\Windows\System\MsgoKmA.exe
  C:\Windows\System\MsgoKmA.exe
  2⤵
  PID:7308
- C:\Windows\System\RpZtlNq.exe
  C:\Windows\System\RpZtlNq.exe
  2⤵
  PID:7712
- C:\Windows\System\zsHEYjc.exe
  C:\Windows\System\zsHEYjc.exe
  2⤵
  PID:7768
- C:\Windows\System\ipDcntC.exe
  C:\Windows\System\ipDcntC.exe
  2⤵
  PID:7752
- C:\Windows\System\Evfpiyi.exe
  C:\Windows\System\Evfpiyi.exe
  2⤵
  PID:8200
- C:\Windows\System\OuYylKO.exe
  C:\Windows\System\OuYylKO.exe
  2⤵
  PID:8232
- C:\Windows\System\KXHsaGb.exe
  C:\Windows\System\KXHsaGb.exe
  2⤵
  PID:8264
- C:\Windows\System\cxQRmYj.exe
  C:\Windows\System\cxQRmYj.exe
  2⤵
  PID:8296
- C:\Windows\System\tZXYCDN.exe
  C:\Windows\System\tZXYCDN.exe
  2⤵
  PID:8336
- C:\Windows\System\WPddKkP.exe
  C:\Windows\System\WPddKkP.exe
  2⤵
  PID:8364
- C:\Windows\System\tDulgCy.exe
  C:\Windows\System\tDulgCy.exe
  2⤵
  PID:8404
- C:\Windows\System\CrbecRU.exe
  C:\Windows\System\CrbecRU.exe
  2⤵
  PID:8456
- C:\Windows\System\mvUAWBr.exe
  C:\Windows\System\mvUAWBr.exe
  2⤵
  PID:8508
- C:\Windows\System\sNsyxwk.exe
  C:\Windows\System\sNsyxwk.exe
  2⤵
  PID:8544
- C:\Windows\System\pZjmEZU.exe
  C:\Windows\System\pZjmEZU.exe
  2⤵
  PID:8572
- C:\Windows\System\RtYBbyn.exe
  C:\Windows\System\RtYBbyn.exe
  2⤵
  PID:8596
- C:\Windows\System\lODFkYP.exe
  C:\Windows\System\lODFkYP.exe
  2⤵
  PID:8640
- C:\Windows\System\LRSuauH.exe
  C:\Windows\System\LRSuauH.exe
  2⤵
  PID:8672
- C:\Windows\System\NrXQxFN.exe
  C:\Windows\System\NrXQxFN.exe
  2⤵
  PID:8688
- C:\Windows\System\lcUuBfr.exe
  C:\Windows\System\lcUuBfr.exe
  2⤵
  PID:8732
- C:\Windows\System\ptJovAq.exe
  C:\Windows\System\ptJovAq.exe
  2⤵
  PID:8760
- C:\Windows\System\xAZTGwW.exe
  C:\Windows\System\xAZTGwW.exe
  2⤵
  PID:8784
- C:\Windows\System\uzfFdLF.exe
  C:\Windows\System\uzfFdLF.exe
  2⤵
  PID:8816
- C:\Windows\System\kMlYQXC.exe
  C:\Windows\System\kMlYQXC.exe
  2⤵
  PID:8840
- C:\Windows\System\idRjFMz.exe
  C:\Windows\System\idRjFMz.exe
  2⤵
  PID:8864
- C:\Windows\System\TFmWcUV.exe
  C:\Windows\System\TFmWcUV.exe
  2⤵
  PID:8880
- C:\Windows\System\SYlsVGh.exe
  C:\Windows\System\SYlsVGh.exe
  2⤵
  PID:8900
- C:\Windows\System\EXDEdmu.exe
  C:\Windows\System\EXDEdmu.exe
  2⤵
  PID:8924
- C:\Windows\System\hnyFMMM.exe
  C:\Windows\System\hnyFMMM.exe
  2⤵
  PID:8956
- C:\Windows\System\BNbPLCK.exe
  C:\Windows\System\BNbPLCK.exe
  2⤵
  PID:8984
- C:\Windows\System\duRqSUd.exe
  C:\Windows\System\duRqSUd.exe
  2⤵
  PID:9008
- C:\Windows\System\DqvqYsd.exe
  C:\Windows\System\DqvqYsd.exe
  2⤵
  PID:9048
- C:\Windows\System\SLdChRr.exe
  C:\Windows\System\SLdChRr.exe
  2⤵
  PID:9080
- C:\Windows\System\VUnlasJ.exe
  C:\Windows\System\VUnlasJ.exe
  2⤵
  PID:9116
- C:\Windows\System\RDKCRtI.exe
  C:\Windows\System\RDKCRtI.exe
  2⤵
  PID:9144
- C:\Windows\System\ERsttOC.exe
  C:\Windows\System\ERsttOC.exe
  2⤵
  PID:9164
- C:\Windows\System\jwUHvns.exe
  C:\Windows\System\jwUHvns.exe
  2⤵
  PID:9192
- C:\Windows\System\KSUNdhP.exe
  C:\Windows\System\KSUNdhP.exe
  2⤵
  PID:7564
- C:\Windows\System\TIuNORW.exe
  C:\Windows\System\TIuNORW.exe
  2⤵
  PID:8140
- C:\Windows\System\cGLcnrI.exe
  C:\Windows\System\cGLcnrI.exe
  2⤵
  PID:8112
- C:\Windows\System\fGYIppB.exe
  C:\Windows\System\fGYIppB.exe
  2⤵
  PID:8184
- C:\Windows\System\dXbWEfV.exe
  C:\Windows\System\dXbWEfV.exe
  2⤵
  PID:7528
- C:\Windows\System\LRrMqtW.exe
  C:\Windows\System\LRrMqtW.exe
  2⤵
  PID:8244
- C:\Windows\System\rzuIVEu.exe
  C:\Windows\System\rzuIVEu.exe
  2⤵
  PID:8428
- C:\Windows\System\TwwTmvn.exe
  C:\Windows\System\TwwTmvn.exe
  2⤵
  PID:8436
- C:\Windows\System\MEoLAZO.exe
  C:\Windows\System\MEoLAZO.exe
  2⤵
  PID:8492
- C:\Windows\System\iPvhGSL.exe
  C:\Windows\System\iPvhGSL.exe
  2⤵
  PID:8612
- C:\Windows\System\MYkSZgp.exe
  C:\Windows\System\MYkSZgp.exe
  2⤵
  PID:8700
- C:\Windows\System\EcfrwtV.exe
  C:\Windows\System\EcfrwtV.exe
  2⤵
  PID:8852
- C:\Windows\System\RvNEcUC.exe
  C:\Windows\System\RvNEcUC.exe
  2⤵
  PID:8908
- C:\Windows\System\PbsQvMv.exe
  C:\Windows\System\PbsQvMv.exe
  2⤵
  PID:8968
- C:\Windows\System\UnsIFXs.exe
  C:\Windows\System\UnsIFXs.exe
  2⤵
  PID:9000
- C:\Windows\System\dGvCiDV.exe
  C:\Windows\System\dGvCiDV.exe
  2⤵
  PID:9128
- C:\Windows\System\LxSsBBj.exe
  C:\Windows\System\LxSsBBj.exe
  2⤵
  PID:9152
- C:\Windows\System\fuCDeEv.exe
  C:\Windows\System\fuCDeEv.exe
  2⤵
  PID:7952
- C:\Windows\System\oikZuXm.exe
  C:\Windows\System\oikZuXm.exe
  2⤵
  PID:7324
- C:\Windows\System\GoaxgUr.exe
  C:\Windows\System\GoaxgUr.exe
  2⤵
  PID:8256
- C:\Windows\System\TNxcZFb.exe
  C:\Windows\System\TNxcZFb.exe
  2⤵
  PID:8344
- C:\Windows\System\QOFscdw.exe
  C:\Windows\System\QOFscdw.exe
  2⤵
  PID:8552
- C:\Windows\System\ZoPhraG.exe
  C:\Windows\System\ZoPhraG.exe
  2⤵
  PID:8652
- C:\Windows\System\arWKupZ.exe
  C:\Windows\System\arWKupZ.exe
  2⤵
  PID:8828
- C:\Windows\System\xylDvoe.exe
  C:\Windows\System\xylDvoe.exe
  2⤵
  PID:8992
- C:\Windows\System\YFfuYrO.exe
  C:\Windows\System\YFfuYrO.exe
  2⤵
  PID:9096
- C:\Windows\System\rHkMIrr.exe
  C:\Windows\System\rHkMIrr.exe
  2⤵
  PID:9208
- C:\Windows\System\BFCiiPm.exe
  C:\Windows\System\BFCiiPm.exe
  2⤵
  PID:7904
- C:\Windows\System\YhfbfKU.exe
  C:\Windows\System\YhfbfKU.exe
  2⤵
  PID:8352
- C:\Windows\System\rFFeJew.exe
  C:\Windows\System\rFFeJew.exe
  2⤵
  PID:8804
- C:\Windows\System\eeOqaBY.exe
  C:\Windows\System\eeOqaBY.exe
  2⤵
  PID:9024
- C:\Windows\System\gCOVyaD.exe
  C:\Windows\System\gCOVyaD.exe
  2⤵
  PID:8292
- C:\Windows\System\gFmiwZm.exe
  C:\Windows\System\gFmiwZm.exe
  2⤵
  PID:9236
- C:\Windows\System\UEdVZJk.exe
  C:\Windows\System\UEdVZJk.exe
  2⤵
  PID:9268
- C:\Windows\System\vZttdFh.exe
  C:\Windows\System\vZttdFh.exe
  2⤵
  PID:9292
- C:\Windows\System\tAwAeZY.exe
  C:\Windows\System\tAwAeZY.exe
  2⤵
  PID:9320
- C:\Windows\System\bpcmQuQ.exe
  C:\Windows\System\bpcmQuQ.exe
  2⤵
  PID:9340
- C:\Windows\System\OsiGsob.exe
  C:\Windows\System\OsiGsob.exe
  2⤵
  PID:9364
- C:\Windows\System\HsjGonW.exe
  C:\Windows\System\HsjGonW.exe
  2⤵
  PID:9392
- C:\Windows\System\vyfNcOj.exe
  C:\Windows\System\vyfNcOj.exe
  2⤵
  PID:9420
- C:\Windows\System\mPenkmC.exe
  C:\Windows\System\mPenkmC.exe
  2⤵
  PID:9440
- C:\Windows\System\QmIcEcL.exe
  C:\Windows\System\QmIcEcL.exe
  2⤵
  PID:9464
- C:\Windows\System\IoxrKLa.exe
  C:\Windows\System\IoxrKLa.exe
  2⤵
  PID:9496
- C:\Windows\System\VtKkCbr.exe
  C:\Windows\System\VtKkCbr.exe
  2⤵
  PID:9516
- C:\Windows\System\mcMqtaX.exe
  C:\Windows\System\mcMqtaX.exe
  2⤵
  PID:9544
- C:\Windows\System\DQstaLa.exe
  C:\Windows\System\DQstaLa.exe
  2⤵
  PID:9568
- C:\Windows\System\IKmYBbS.exe
  C:\Windows\System\IKmYBbS.exe
  2⤵
  PID:9604
- C:\Windows\System\ovFCKdW.exe
  C:\Windows\System\ovFCKdW.exe
  2⤵
  PID:9640
- C:\Windows\System\hsqlGTj.exe
  C:\Windows\System\hsqlGTj.exe
  2⤵
  PID:9660
- C:\Windows\System\FWXOAfq.exe
  C:\Windows\System\FWXOAfq.exe
  2⤵
  PID:9684
- C:\Windows\System\AJPhbRV.exe
  C:\Windows\System\AJPhbRV.exe
  2⤵
  PID:9700
- C:\Windows\System\LtpHSDM.exe
  C:\Windows\System\LtpHSDM.exe
  2⤵
  PID:9732
- C:\Windows\System\UTNiYfW.exe
  C:\Windows\System\UTNiYfW.exe
  2⤵
  PID:9748
- C:\Windows\System\emYNGho.exe
  C:\Windows\System\emYNGho.exe
  2⤵
  PID:9764
- C:\Windows\System\SfNPJwc.exe
  C:\Windows\System\SfNPJwc.exe
  2⤵
  PID:9788
- C:\Windows\System\hBcsIJa.exe
  C:\Windows\System\hBcsIJa.exe
  2⤵
  PID:9824
- C:\Windows\System\yZEpvOi.exe
  C:\Windows\System\yZEpvOi.exe
  2⤵
  PID:9852
- C:\Windows\System\WIBhcpR.exe
  C:\Windows\System\WIBhcpR.exe
  2⤵
  PID:9916
- C:\Windows\System\WaBvSNS.exe
  C:\Windows\System\WaBvSNS.exe
  2⤵
  PID:9944
- C:\Windows\System\kORkvfk.exe
  C:\Windows\System\kORkvfk.exe
  2⤵
  PID:9980
- C:\Windows\System\ZIimtSQ.exe
  C:\Windows\System\ZIimtSQ.exe
  2⤵
  PID:10008
- C:\Windows\System\SmCMIxc.exe
  C:\Windows\System\SmCMIxc.exe
  2⤵
  PID:10032
- C:\Windows\System\fWbscBE.exe
  C:\Windows\System\fWbscBE.exe
  2⤵
  PID:10056
- C:\Windows\System\JZZTizt.exe
  C:\Windows\System\JZZTizt.exe
  2⤵
  PID:10088
- C:\Windows\System\YcypzEw.exe
  C:\Windows\System\YcypzEw.exe
  2⤵
  PID:10120
- C:\Windows\System\qpRBPtJ.exe
  C:\Windows\System\qpRBPtJ.exe
  2⤵
  PID:10140
- C:\Windows\System\ImkPPZQ.exe
  C:\Windows\System\ImkPPZQ.exe
  2⤵
  PID:10164
- C:\Windows\System\lskVdQl.exe
  C:\Windows\System\lskVdQl.exe
  2⤵
  PID:10184
- C:\Windows\System\gycbxJq.exe
  C:\Windows\System\gycbxJq.exe
  2⤵
  PID:10212
- C:\Windows\System\bxTXqPM.exe
  C:\Windows\System\bxTXqPM.exe
  2⤵
  PID:10232
- C:\Windows\System\FUDHnMD.exe
  C:\Windows\System\FUDHnMD.exe
  2⤵
  PID:9220
- C:\Windows\System\kbHzGNp.exe
  C:\Windows\System\kbHzGNp.exe
  2⤵
  PID:9256
- C:\Windows\System\avHwFpf.exe
  C:\Windows\System\avHwFpf.exe
  2⤵
  PID:9332
- C:\Windows\System\HyerqgO.exe
  C:\Windows\System\HyerqgO.exe
  2⤵
  PID:9432
- C:\Windows\System\QhsAPHH.exe
  C:\Windows\System\QhsAPHH.exe
  2⤵
  PID:9460
- C:\Windows\System\uwTRpyP.exe
  C:\Windows\System\uwTRpyP.exe
  2⤵
  PID:9428
- C:\Windows\System\fyMfxhP.exe
  C:\Windows\System\fyMfxhP.exe
  2⤵
  PID:9636
- C:\Windows\System\ZlSxCcX.exe
  C:\Windows\System\ZlSxCcX.exe
  2⤵
  PID:9580
- C:\Windows\System\moKHVHc.exe
  C:\Windows\System\moKHVHc.exe
  2⤵
  PID:9744
- C:\Windows\System\vfJdoXt.exe
  C:\Windows\System\vfJdoXt.exe
  2⤵
  PID:9840
- C:\Windows\System\rwjwtsN.exe
  C:\Windows\System\rwjwtsN.exe
  2⤵
  PID:9784
- C:\Windows\System\qwnjWFO.exe
  C:\Windows\System\qwnjWFO.exe
  2⤵
  PID:9720
- C:\Windows\System\RvzEWme.exe
  C:\Windows\System\RvzEWme.exe
  2⤵
  PID:9956
- C:\Windows\System\jLFSQjA.exe
  C:\Windows\System\jLFSQjA.exe
  2⤵
  PID:9988
- C:\Windows\System\zVDhInP.exe
  C:\Windows\System\zVDhInP.exe
  2⤵
  PID:10020
- C:\Windows\System\DTzuxTL.exe
  C:\Windows\System\DTzuxTL.exe
  2⤵
  PID:10052
- C:\Windows\System\QYOPFOO.exe
  C:\Windows\System\QYOPFOO.exe
  2⤵
  PID:10208
- C:\Windows\System\esFMbXQ.exe
  C:\Windows\System\esFMbXQ.exe
  2⤵
  PID:10156
- C:\Windows\System\HXMhiCq.exe
  C:\Windows\System\HXMhiCq.exe
  2⤵
  PID:8660
- C:\Windows\System\PWpeZvC.exe
  C:\Windows\System\PWpeZvC.exe
  2⤵
  PID:9276
- C:\Windows\System\HARJpHU.exe
  C:\Windows\System\HARJpHU.exe
  2⤵
  PID:10224
- C:\Windows\System\kpwLvTF.exe
  C:\Windows\System\kpwLvTF.exe
  2⤵
  PID:9508
- C:\Windows\System\zKHCrct.exe
  C:\Windows\System\zKHCrct.exe
  2⤵
  PID:9892
- C:\Windows\System\VBTnnAS.exe
  C:\Windows\System\VBTnnAS.exe
  2⤵
  PID:9676
- C:\Windows\System\UCobgcn.exe
  C:\Windows\System\UCobgcn.exe
  2⤵
  PID:9632
- C:\Windows\System\PFWtxlT.exe
  C:\Windows\System\PFWtxlT.exe
  2⤵
  PID:9476
- C:\Windows\System\FOYsrfb.exe
  C:\Windows\System\FOYsrfb.exe
  2⤵
  PID:10248
- C:\Windows\System\jmBLfKF.exe
  C:\Windows\System\jmBLfKF.exe
  2⤵
  PID:10268
- C:\Windows\System\LxWOeDH.exe
  C:\Windows\System\LxWOeDH.exe
  2⤵
  PID:10300
- C:\Windows\System\iugbtQB.exe
  C:\Windows\System\iugbtQB.exe
  2⤵
  PID:10320
- C:\Windows\System\VDUjTCZ.exe
  C:\Windows\System\VDUjTCZ.exe
  2⤵
  PID:10352
- C:\Windows\System\eflasWS.exe
  C:\Windows\System\eflasWS.exe
  2⤵
  PID:10392
- C:\Windows\System\aCZBwBt.exe
  C:\Windows\System\aCZBwBt.exe
  2⤵
  PID:10460
- C:\Windows\System\wwzDNBq.exe
  C:\Windows\System\wwzDNBq.exe
  2⤵
  PID:10492
- C:\Windows\System\xnnMfIC.exe
  C:\Windows\System\xnnMfIC.exe
  2⤵
  PID:10520
- C:\Windows\System\bHybbJt.exe
  C:\Windows\System\bHybbJt.exe
  2⤵
  PID:10552
- C:\Windows\System\agoFQNg.exe
  C:\Windows\System\agoFQNg.exe
  2⤵
  PID:10612
- C:\Windows\System\gCLKxpd.exe
  C:\Windows\System\gCLKxpd.exe
  2⤵
  PID:10672
- C:\Windows\System\EYLLfAy.exe
  C:\Windows\System\EYLLfAy.exe
  2⤵
  PID:10688
- C:\Windows\System\WOfEIZc.exe
  C:\Windows\System\WOfEIZc.exe
  2⤵
  PID:10716
- C:\Windows\System\BinMsDr.exe
  C:\Windows\System\BinMsDr.exe
  2⤵
  PID:10740
- C:\Windows\System\oZhGLce.exe
  C:\Windows\System\oZhGLce.exe
  2⤵
  PID:10768
- C:\Windows\System\QZvblvu.exe
  C:\Windows\System\QZvblvu.exe
  2⤵
  PID:10800
- C:\Windows\System\pUwMRuS.exe
  C:\Windows\System\pUwMRuS.exe
  2⤵
  PID:10840
- C:\Windows\System\pRmOUIm.exe
  C:\Windows\System\pRmOUIm.exe
  2⤵
  PID:10856
- C:\Windows\System\njfdPzZ.exe
  C:\Windows\System\njfdPzZ.exe
  2⤵
  PID:10920
- C:\Windows\System\CweniEt.exe
  C:\Windows\System\CweniEt.exe
  2⤵
  PID:10968
- C:\Windows\System\IFKkfzg.exe
  C:\Windows\System\IFKkfzg.exe
  2⤵
  PID:10984
- C:\Windows\System\vARYhyE.exe
  C:\Windows\System\vARYhyE.exe
  2⤵
  PID:11016
- C:\Windows\System\BeHpyXz.exe
  C:\Windows\System\BeHpyXz.exe
  2⤵
  PID:11052
- C:\Windows\System\JfgPMxE.exe
  C:\Windows\System\JfgPMxE.exe
  2⤵
  PID:11104
- C:\Windows\System\jDtZrco.exe
  C:\Windows\System\jDtZrco.exe
  2⤵
  PID:11124
- C:\Windows\System\EdIRmov.exe
  C:\Windows\System\EdIRmov.exe
  2⤵
  PID:11160
- C:\Windows\System\RCAIOlJ.exe
  C:\Windows\System\RCAIOlJ.exe
  2⤵
  PID:11184
- C:\Windows\System\ghfDytX.exe
  C:\Windows\System\ghfDytX.exe
  2⤵
  PID:11216
- C:\Windows\System\BaNQwNw.exe
  C:\Windows\System\BaNQwNw.exe
  2⤵
  PID:11244
- C:\Windows\System\BkoOaoI.exe
  C:\Windows\System\BkoOaoI.exe
  2⤵
  PID:4348
- C:\Windows\System\bpcbfsJ.exe
  C:\Windows\System\bpcbfsJ.exe
  2⤵
  PID:9224
- C:\Windows\System\PorBKiW.exe
  C:\Windows\System\PorBKiW.exe
  2⤵
  PID:884
- C:\Windows\System\ZKltZDr.exe
  C:\Windows\System\ZKltZDr.exe
  2⤵
  PID:9628
- C:\Windows\System\QJDOqEz.exe
  C:\Windows\System\QJDOqEz.exe
  2⤵
  PID:10400
- C:\Windows\System\WUbdsqO.exe
  C:\Windows\System\WUbdsqO.exe
  2⤵
  PID:10424
- C:\Windows\System\QarlfHW.exe
  C:\Windows\System\QarlfHW.exe
  2⤵
  PID:10264
- C:\Windows\System\eLpIedX.exe
  C:\Windows\System\eLpIedX.exe
  2⤵
  PID:10364
- C:\Windows\System\lrnKKzw.exe
  C:\Windows\System\lrnKKzw.exe
  2⤵
  PID:10568
- C:\Windows\System\VtfjEVK.exe
  C:\Windows\System\VtfjEVK.exe
  2⤵
  PID:10636
- C:\Windows\System\zoJIKkG.exe
  C:\Windows\System\zoJIKkG.exe
  2⤵
  PID:10680
- C:\Windows\System\YYfzEnv.exe
  C:\Windows\System\YYfzEnv.exe
  2⤵
  PID:10728
- C:\Windows\System\xuFaAMo.exe
  C:\Windows\System\xuFaAMo.exe
  2⤵
  PID:10764
- C:\Windows\System\GpSCRBH.exe
  C:\Windows\System\GpSCRBH.exe
  2⤵
  PID:10868
- C:\Windows\System\OlnSbEf.exe
  C:\Windows\System\OlnSbEf.exe
  2⤵
  PID:10928
- C:\Windows\System\mEjTCkL.exe
  C:\Windows\System\mEjTCkL.exe
  2⤵
  PID:11044
- C:\Windows\System\WjqcMfZ.exe
  C:\Windows\System\WjqcMfZ.exe
  2⤵
  PID:11088
- C:\Windows\System\lPhFkoY.exe
  C:\Windows\System\lPhFkoY.exe
  2⤵
  PID:11132
- C:\Windows\System\ZkqnQjQ.exe
  C:\Windows\System\ZkqnQjQ.exe
  2⤵
  PID:11180
- C:\Windows\System\qaoLUlw.exe
  C:\Windows\System\qaoLUlw.exe
  2⤵
  PID:5072
- C:\Windows\System\NTeMkHZ.exe
  C:\Windows\System\NTeMkHZ.exe
  2⤵
  PID:4808
- C:\Windows\System\ebrilOn.exe
  C:\Windows\System\ebrilOn.exe
  2⤵
  PID:5096
- C:\Windows\System\ioGuhqq.exe
  C:\Windows\System\ioGuhqq.exe
  2⤵
  PID:9376
- C:\Windows\System\pJZnCGD.exe
  C:\Windows\System\pJZnCGD.exe
  2⤵
  PID:9264
- C:\Windows\System\CKEUoZc.exe
  C:\Windows\System\CKEUoZc.exe
  2⤵
  PID:10340
- C:\Windows\System\mSsXqmD.exe
  C:\Windows\System\mSsXqmD.exe
  2⤵
  PID:10312
- C:\Windows\System\rJqCtDO.exe
  C:\Windows\System\rJqCtDO.exe
  2⤵
  PID:10512
- C:\Windows\System\SWsazgg.exe
  C:\Windows\System\SWsazgg.exe
  2⤵
  PID:10756
- C:\Windows\System\cJyToss.exe
  C:\Windows\System\cJyToss.exe
  2⤵
  PID:10796
- C:\Windows\System\ySYbTzx.exe
  C:\Windows\System\ySYbTzx.exe
  2⤵
  PID:10948
- C:\Windows\System\bFkRdht.exe
  C:\Windows\System\bFkRdht.exe
  2⤵
  PID:11076
- C:\Windows\System\FyATcBF.exe
  C:\Windows\System\FyATcBF.exe
  2⤵
  PID:11236
- C:\Windows\System\ZDRinvX.exe
  C:\Windows\System\ZDRinvX.exe
  2⤵
  PID:11260
- C:\Windows\System\LLsGBFX.exe
  C:\Windows\System\LLsGBFX.exe
  2⤵
  PID:10808
- C:\Windows\System\LFAkFNl.exe
  C:\Windows\System\LFAkFNl.exe
  2⤵
  PID:10812
- C:\Windows\System\WaCmXtw.exe
  C:\Windows\System\WaCmXtw.exe
  2⤵
  PID:10332
- C:\Windows\System\qARkCLw.exe
  C:\Windows\System\qARkCLw.exe
  2⤵
  PID:11304
- C:\Windows\System\RZSoVOW.exe
  C:\Windows\System\RZSoVOW.exe
  2⤵
  PID:11336
- C:\Windows\System\jYpmBAx.exe
  C:\Windows\System\jYpmBAx.exe
  2⤵
  PID:11368
- C:\Windows\System\fXLlYXt.exe
  C:\Windows\System\fXLlYXt.exe
  2⤵
  PID:11404
- C:\Windows\System\LRTmgnV.exe
  C:\Windows\System\LRTmgnV.exe
  2⤵
  PID:11424
- C:\Windows\System\ZXAmsRM.exe
  C:\Windows\System\ZXAmsRM.exe
  2⤵
  PID:11448
- C:\Windows\System\bhufORr.exe
  C:\Windows\System\bhufORr.exe
  2⤵
  PID:11464
- C:\Windows\System\uPNOxfe.exe
  C:\Windows\System\uPNOxfe.exe
  2⤵
  PID:11480
- C:\Windows\System\RKgkPdp.exe
  C:\Windows\System\RKgkPdp.exe
  2⤵
  PID:11512
- C:\Windows\System\dNHmvzn.exe
  C:\Windows\System\dNHmvzn.exe
  2⤵
  PID:11548
- C:\Windows\System\HqcBiAw.exe
  C:\Windows\System\HqcBiAw.exe
  2⤵
  PID:11576
- C:\Windows\System\EjBadDj.exe
  C:\Windows\System\EjBadDj.exe
  2⤵
  PID:11600
- C:\Windows\System\QknHgPI.exe
  C:\Windows\System\QknHgPI.exe
  2⤵
  PID:11628
- C:\Windows\System\gbTWuYE.exe
  C:\Windows\System\gbTWuYE.exe
  2⤵
  PID:11652
- C:\Windows\System\KcSflKt.exe
  C:\Windows\System\KcSflKt.exe
  2⤵
  PID:11680
- C:\Windows\System\lWLbUii.exe
  C:\Windows\System\lWLbUii.exe
  2⤵
  PID:11740
- C:\Windows\System\yZHQjeH.exe
  C:\Windows\System\yZHQjeH.exe
  2⤵
  PID:11772
- C:\Windows\System\tyJGoCM.exe
  C:\Windows\System\tyJGoCM.exe
  2⤵
  PID:11788
- C:\Windows\System\kxcVfqw.exe
  C:\Windows\System\kxcVfqw.exe
  2⤵
  PID:11824
- C:\Windows\System\tyPWYud.exe
  C:\Windows\System\tyPWYud.exe
  2⤵
  PID:11844
- C:\Windows\System\pbwkVnw.exe
  C:\Windows\System\pbwkVnw.exe
  2⤵
  PID:11872
- C:\Windows\System\lXHSHvr.exe
  C:\Windows\System\lXHSHvr.exe
  2⤵
  PID:11900
- C:\Windows\System\mBwKuov.exe
  C:\Windows\System\mBwKuov.exe
  2⤵
  PID:11920
- C:\Windows\System\pBHqRoO.exe
  C:\Windows\System\pBHqRoO.exe
  2⤵
  PID:11944
- C:\Windows\System\DYcDQAy.exe
  C:\Windows\System\DYcDQAy.exe
  2⤵
  PID:11964
- C:\Windows\System\fcODgfA.exe
  C:\Windows\System\fcODgfA.exe
  2⤵
  PID:11996
- C:\Windows\System\csEdpuV.exe
  C:\Windows\System\csEdpuV.exe
  2⤵
  PID:12024
- C:\Windows\System\OAPjnkZ.exe
  C:\Windows\System\OAPjnkZ.exe
  2⤵
  PID:12060
- C:\Windows\System\AElTNPt.exe
  C:\Windows\System\AElTNPt.exe
  2⤵
  PID:12080
- C:\Windows\System\phINXzw.exe
  C:\Windows\System\phINXzw.exe
  2⤵
  PID:12108
- C:\Windows\System\BZDLxwx.exe
  C:\Windows\System\BZDLxwx.exe
  2⤵
  PID:12128
- C:\Windows\System\wnfSmLc.exe
  C:\Windows\System\wnfSmLc.exe
  2⤵
  PID:12144
- C:\Windows\System\jsWWDRJ.exe
  C:\Windows\System\jsWWDRJ.exe
  2⤵
  PID:12164
- C:\Windows\System\FupMkgI.exe
  C:\Windows\System\FupMkgI.exe
  2⤵
  PID:12188
- C:\Windows\System\MdvAEgJ.exe
  C:\Windows\System\MdvAEgJ.exe
  2⤵
  PID:12208
- C:\Windows\System\ryPwqKg.exe
  C:\Windows\System\ryPwqKg.exe
  2⤵
  PID:12240
- C:\Windows\System\XAOSwHT.exe
  C:\Windows\System\XAOSwHT.exe
  2⤵
  PID:12268
- C:\Windows\System\erVkECp.exe
  C:\Windows\System\erVkECp.exe
  2⤵
  PID:3484
- C:\Windows\System\ZSDKLjp.exe
  C:\Windows\System\ZSDKLjp.exe
  2⤵
  PID:10628
- C:\Windows\System\imBqwMM.exe
  C:\Windows\System\imBqwMM.exe
  2⤵
  PID:11312
- C:\Windows\System\hbPeqXx.exe
  C:\Windows\System\hbPeqXx.exe
  2⤵
  PID:4208
- C:\Windows\System\EQYSWdM.exe
  C:\Windows\System\EQYSWdM.exe
  2⤵
  PID:11360
- C:\Windows\System\MQsCwwX.exe
  C:\Windows\System\MQsCwwX.exe
  2⤵
  PID:11376
- C:\Windows\System\VJvhtLR.exe
  C:\Windows\System\VJvhtLR.exe
  2⤵
  PID:11440
- C:\Windows\System\ovBlMOL.exe
  C:\Windows\System\ovBlMOL.exe
  2⤵
  PID:11460
- C:\Windows\System\aftpOUa.exe
  C:\Windows\System\aftpOUa.exe
  2⤵
  PID:11596
- C:\Windows\System\uSFQcCx.exe
  C:\Windows\System\uSFQcCx.exe
  2⤵
  PID:11640
- C:\Windows\System\qDrkdZV.exe
  C:\Windows\System\qDrkdZV.exe
  2⤵
  PID:11616
- C:\Windows\System\qTPUMdj.exe
  C:\Windows\System\qTPUMdj.exe
  2⤵
  PID:4776
- C:\Windows\System\fhgIuhO.exe
  C:\Windows\System\fhgIuhO.exe
  2⤵
  PID:11780
- C:\Windows\System\GbaAgTs.exe
  C:\Windows\System\GbaAgTs.exe
  2⤵
  PID:11840
- C:\Windows\System\IMWCbMd.exe
  C:\Windows\System\IMWCbMd.exe
  2⤵
  PID:12016
- C:\Windows\System\lmVnmEb.exe
  C:\Windows\System\lmVnmEb.exe
  2⤵
  PID:11932
- C:\Windows\System\iLVKUic.exe
  C:\Windows\System\iLVKUic.exe
  2⤵
  PID:12012
- C:\Windows\System\hJHhFQg.exe
  C:\Windows\System\hJHhFQg.exe
  2⤵
  PID:12176
- C:\Windows\System\auxrcUm.exe
  C:\Windows\System\auxrcUm.exe
  2⤵
  PID:12228
- C:\Windows\System\weZxRHb.exe
  C:\Windows\System\weZxRHb.exe
  2⤵
  PID:11352
- C:\Windows\System\eQQNgiG.exe
  C:\Windows\System\eQQNgiG.exe
  2⤵
  PID:11584
- C:\Windows\System\rlGZJKx.exe
  C:\Windows\System\rlGZJKx.exe
  2⤵
  PID:11716
- C:\Windows\System\zoLNZCB.exe
  C:\Windows\System\zoLNZCB.exe
  2⤵
  PID:12276
- C:\Windows\System\zuJsBpl.exe
  C:\Windows\System\zuJsBpl.exe
  2⤵
  PID:12036
- C:\Windows\System\nIaYQSK.exe
  C:\Windows\System\nIaYQSK.exe
  2⤵
  PID:11532
- C:\Windows\System\QZYHwjx.exe
  C:\Windows\System\QZYHwjx.exe
  2⤵
  PID:11620
- C:\Windows\System\RLQNUpb.exe
  C:\Windows\System\RLQNUpb.exe
  2⤵
  PID:11528
- C:\Windows\System\mXtGwIQ.exe
  C:\Windows\System\mXtGwIQ.exe
  2⤵
  PID:12328
- C:\Windows\System\XdkUdbN.exe
  C:\Windows\System\XdkUdbN.exe
  2⤵
  PID:12348
- C:\Windows\System\NskstnU.exe
  C:\Windows\System\NskstnU.exe
  2⤵
  PID:12368
- C:\Windows\System\nVZyFQS.exe
  C:\Windows\System\nVZyFQS.exe
  2⤵
  PID:12388
- C:\Windows\System\mjkqlkK.exe
  C:\Windows\System\mjkqlkK.exe
  2⤵
  PID:12404
- C:\Windows\System\XMCWSvK.exe
  C:\Windows\System\XMCWSvK.exe
  2⤵
  PID:12432
- C:\Windows\System\LYdNOSN.exe
  C:\Windows\System\LYdNOSN.exe
  2⤵
  PID:12452
- C:\Windows\System\KeCegaG.exe
  C:\Windows\System\KeCegaG.exe
  2⤵
  PID:12480
- C:\Windows\System\ztxzNmp.exe
  C:\Windows\System\ztxzNmp.exe
  2⤵
  PID:12508
- C:\Windows\System\FhrxGgu.exe
  C:\Windows\System\FhrxGgu.exe
  2⤵
  PID:12568
- C:\Windows\System\WtxrUJt.exe
  C:\Windows\System\WtxrUJt.exe
  2⤵
  PID:12624
- C:\Windows\System\MpXXSYz.exe
  C:\Windows\System\MpXXSYz.exe
  2⤵
  PID:12652
- C:\Windows\System\xvaJgWX.exe
  C:\Windows\System\xvaJgWX.exe
  2⤵
  PID:12704
- C:\Windows\System\kFGrjuy.exe
  C:\Windows\System\kFGrjuy.exe
  2⤵
  PID:12732
- C:\Windows\System\VVxGhga.exe
  C:\Windows\System\VVxGhga.exe
  2⤵
  PID:12760
- C:\Windows\System\FTqKarI.exe
  C:\Windows\System\FTqKarI.exe
  2⤵
  PID:12788
- C:\Windows\System\vZYGApe.exe
  C:\Windows\System\vZYGApe.exe
  2⤵
  PID:12804
- C:\Windows\System\GfVNxko.exe
  C:\Windows\System\GfVNxko.exe
  2⤵
  PID:12820
- C:\Windows\System\WeKjJph.exe
  C:\Windows\System\WeKjJph.exe
  2⤵
  PID:12848
- C:\Windows\System\rsofpcv.exe
  C:\Windows\System\rsofpcv.exe
  2⤵
  PID:12880
- C:\Windows\System\GAjXCku.exe
  C:\Windows\System\GAjXCku.exe
  2⤵
  PID:12912
- C:\Windows\System\JIVbesO.exe
  C:\Windows\System\JIVbesO.exe
  2⤵
  PID:12940
- C:\Windows\System\xqXlrzw.exe
  C:\Windows\System\xqXlrzw.exe
  2⤵
  PID:12956
- C:\Windows\System\qGOPtWL.exe
  C:\Windows\System\qGOPtWL.exe
  2⤵
  PID:12992
- C:\Windows\System\hypWIKt.exe
  C:\Windows\System\hypWIKt.exe
  2⤵
  PID:13016
- C:\Windows\System\kzzlrEI.exe
  C:\Windows\System\kzzlrEI.exe
  2⤵
  PID:13044
- C:\Windows\System\oDznChd.exe
  C:\Windows\System\oDznChd.exe
  2⤵
  PID:13068
- C:\Windows\System\tbgYLrj.exe
  C:\Windows\System\tbgYLrj.exe
  2⤵
  PID:13096
- C:\Windows\System\ihdeIpf.exe
  C:\Windows\System\ihdeIpf.exe
  2⤵
  PID:13112
- C:\Windows\System\voOjtHj.exe
  C:\Windows\System\voOjtHj.exe
  2⤵
  PID:13132
- C:\Windows\System\FUvHwhR.exe
  C:\Windows\System\FUvHwhR.exe
  2⤵
  PID:13164
- C:\Windows\System\zvujZwV.exe
  C:\Windows\System\zvujZwV.exe
  2⤵
  PID:13184
- C:\Windows\System\PnbrpXb.exe
  C:\Windows\System\PnbrpXb.exe
  2⤵
  PID:13212
- C:\Windows\System\BmDhkdz.exe
  C:\Windows\System\BmDhkdz.exe
  2⤵
  PID:13236
- C:\Windows\System\IzovfGg.exe
  C:\Windows\System\IzovfGg.exe
  2⤵
  PID:13260
- C:\Windows\System\VDIKHWt.exe
  C:\Windows\System\VDIKHWt.exe
  2⤵
  PID:13292
- C:\Windows\System\PmkSPOr.exe
  C:\Windows\System\PmkSPOr.exe
  2⤵
  PID:12092
- C:\Windows\System\bVDiytw.exe
  C:\Windows\System\bVDiytw.exe
  2⤵
  PID:12324
- C:\Windows\System\uubjJmp.exe
  C:\Windows\System\uubjJmp.exe
  2⤵
  PID:12476
- C:\Windows\System\joIrjyU.exe
  C:\Windows\System\joIrjyU.exe
  2⤵
  PID:12504
- C:\Windows\System\KQzCbbw.exe
  C:\Windows\System\KQzCbbw.exe
  2⤵
  PID:12676
- C:\Windows\System\IRZwrcu.exe
  C:\Windows\System\IRZwrcu.exe
  2⤵
  PID:12728
- C:\Windows\System\rCeLzel.exe
  C:\Windows\System\rCeLzel.exe
  2⤵
  PID:12772
- C:\Windows\System\WcuZxGT.exe
  C:\Windows\System\WcuZxGT.exe
  2⤵
  PID:12860
- C:\Windows\System\ohEIUdb.exe
  C:\Windows\System\ohEIUdb.exe
  2⤵
  PID:12840
- C:\Windows\System\tuOLSYf.exe
  C:\Windows\System\tuOLSYf.exe
  2⤵
  PID:12900
- C:\Windows\System\YaQFYIu.exe
  C:\Windows\System\YaQFYIu.exe
  2⤵
  PID:12928
- C:\Windows\System\CZPeHYh.exe
  C:\Windows\System\CZPeHYh.exe
  2⤵
  PID:12952
- C:\Windows\System\bXFMTtw.exe
  C:\Windows\System\bXFMTtw.exe
  2⤵
  PID:13012
- C:\Windows\System\mlAprTO.exe
  C:\Windows\System\mlAprTO.exe
  2⤵
  PID:13056
- C:\Windows\System\GVkehxG.exe
  C:\Windows\System\GVkehxG.exe
  2⤵
  PID:13228
- C:\Windows\System\xqpYotf.exe
  C:\Windows\System\xqpYotf.exe
  2⤵
  PID:13252
- C:\Windows\System\jkxlRPH.exe
  C:\Windows\System\jkxlRPH.exe
  2⤵
  PID:13304
- C:\Windows\System\KTDislN.exe
  C:\Windows\System\KTDislN.exe
  2⤵
  PID:2084
- C:\Windows\System\GOfPMZH.exe
  C:\Windows\System\GOfPMZH.exe
  2⤵
  PID:12488
- C:\Windows\System\tRWVPhq.exe
  C:\Windows\System\tRWVPhq.exe
  2⤵
  PID:12584
- C:\Windows\System\BeVMRYN.exe
  C:\Windows\System\BeVMRYN.exe
  2⤵
  PID:3136
- C:\Windows\System\TwLGNJR.exe
  C:\Windows\System\TwLGNJR.exe
  2⤵
  PID:12796
- C:\Windows\System\aIKicij.exe
  C:\Windows\System\aIKicij.exe
  2⤵
  PID:12892
- C:\Windows\System\wkKtvHu.exe
  C:\Windows\System\wkKtvHu.exe
  2⤵
  PID:1980
- C:\Windows\System\gykZkTr.exe
  C:\Windows\System\gykZkTr.exe
  2⤵
  PID:3048
- C:\Windows\System\bJCCFhA.exe
  C:\Windows\System\bJCCFhA.exe
  2⤵
  PID:13308
- C:\Windows\System\XnvhbAG.exe
  C:\Windows\System\XnvhbAG.exe
  2⤵
  PID:12424
- C:\Windows\System\UrzxsTt.exe
  C:\Windows\System\UrzxsTt.exe
  2⤵
  PID:4600
- C:\Windows\System\ypHdLQz.exe
  C:\Windows\System\ypHdLQz.exe
  2⤵
  PID:12756
- C:\Windows\System\nHZvJps.exe
  C:\Windows\System\nHZvJps.exe
  2⤵
  PID:13272
- C:\Windows\System\fNgILwy.exe
  C:\Windows\System\fNgILwy.exe
  2⤵
  PID:12216
- C:\Windows\System\xBFqJBA.exe
  C:\Windows\System\xBFqJBA.exe
  2⤵
  PID:12812
- C:\Windows\System\nZgdNQl.exe
  C:\Windows\System\nZgdNQl.exe
  2⤵
  PID:12492
- C:\Windows\System\QeVatva.exe
  C:\Windows\System\QeVatva.exe
  2⤵
  PID:13316
- C:\Windows\System\cJHBJPY.exe
  C:\Windows\System\cJHBJPY.exe
  2⤵
  PID:13352
- C:\Windows\System\pKTntUq.exe
  C:\Windows\System\pKTntUq.exe
  2⤵
  PID:13384
- C:\Windows\System\mrDsdFg.exe
  C:\Windows\System\mrDsdFg.exe
  2⤵
  PID:13408
- C:\Windows\System\OmxnpBP.exe
  C:\Windows\System\OmxnpBP.exe
  2⤵
  PID:13424
- C:\Windows\System\QHkiEMl.exe
  C:\Windows\System\QHkiEMl.exe
  2⤵
  PID:13448
- C:\Windows\System\aEoWkVl.exe
  C:\Windows\System\aEoWkVl.exe
  2⤵
  PID:13480
- C:\Windows\System\kIwFbxv.exe
  C:\Windows\System\kIwFbxv.exe
  2⤵
  PID:13508
- C:\Windows\System\UKyMaOC.exe
  C:\Windows\System\UKyMaOC.exe
  2⤵
  PID:13532
- C:\Windows\System\uXGchOg.exe
  C:\Windows\System\uXGchOg.exe
  2⤵
  PID:13552
- C:\Windows\System\xQjTVve.exe
  C:\Windows\System\xQjTVve.exe
  2⤵
  PID:13568
- C:\Windows\System\YUnRnxZ.exe
  C:\Windows\System\YUnRnxZ.exe
  2⤵
  PID:13588
- C:\Windows\System\gSlnaGl.exe
  C:\Windows\System\gSlnaGl.exe
  2⤵
  PID:13608
- C:\Windows\System\QeOSlGC.exe
  C:\Windows\System\QeOSlGC.exe
  2⤵
  PID:13628
- C:\Windows\System\nsvGyJy.exe
  C:\Windows\System\nsvGyJy.exe
  2⤵
  PID:13652
- C:\Windows\System\lyRQWlI.exe
  C:\Windows\System\lyRQWlI.exe
  2⤵
  PID:13680
- C:\Windows\System\SYzFWnR.exe
  C:\Windows\System\SYzFWnR.exe
  2⤵
  PID:13696
- C:\Windows\System\XAYCIJF.exe
  C:\Windows\System\XAYCIJF.exe
  2⤵
  PID:13724
- C:\Windows\System\rLNNXSv.exe
  C:\Windows\System\rLNNXSv.exe
  2⤵
  PID:13748
- C:\Windows\System\YMENfZz.exe
  C:\Windows\System\YMENfZz.exe
  2⤵
  PID:13768
- C:\Windows\System\rYAZylR.exe
  C:\Windows\System\rYAZylR.exe
  2⤵
  PID:13792
- C:\Windows\System\jqjWGRh.exe
  C:\Windows\System\jqjWGRh.exe
  2⤵
  PID:13808
- C:\Windows\System\TkJgSWX.exe
  C:\Windows\System\TkJgSWX.exe
  2⤵
  PID:13832
- C:\Windows\System\OBscXve.exe
  C:\Windows\System\OBscXve.exe
  2⤵
  PID:13848
- C:\Windows\System\pfQJUlM.exe
  C:\Windows\System\pfQJUlM.exe
  2⤵
  PID:13916
- C:\Windows\System\LNxuvqO.exe
  C:\Windows\System\LNxuvqO.exe
  2⤵
  PID:13936
- C:\Windows\System\qntqaSk.exe
  C:\Windows\System\qntqaSk.exe
  2⤵
  PID:13960
- C:\Windows\System\fpdUeXX.exe
  C:\Windows\System\fpdUeXX.exe
  2⤵
  PID:13988
- C:\Windows\System\IqrBcCw.exe
  C:\Windows\System\IqrBcCw.exe
  2⤵
  PID:14032
- C:\Windows\System\kNaTkJZ.exe
  C:\Windows\System\kNaTkJZ.exe
  2⤵
  PID:14052
- C:\Windows\System\uRoDzTz.exe
  C:\Windows\System\uRoDzTz.exe
  2⤵
  PID:14076
- C:\Windows\System\xdqoVkE.exe
  C:\Windows\System\xdqoVkE.exe
  2⤵
  PID:14096
- C:\Windows\System\tKbkmRi.exe
  C:\Windows\System\tKbkmRi.exe
  2⤵
  PID:14116
- C:\Windows\System\lAvbycr.exe
  C:\Windows\System\lAvbycr.exe
  2⤵
  PID:14132
- C:\Windows\System\ABIgDGb.exe
  C:\Windows\System\ABIgDGb.exe
  2⤵
  PID:14164
- C:\Windows\System\DnMyyln.exe
  C:\Windows\System\DnMyyln.exe
  2⤵
  PID:14192
- C:\Windows\System\ywtFwDF.exe
  C:\Windows\System\ywtFwDF.exe
  2⤵
  PID:14220
- C:\Windows\System\ibhYsKn.exe
  C:\Windows\System\ibhYsKn.exe
  2⤵
  PID:14240
- C:\Windows\System\xVovIgL.exe
  C:\Windows\System\xVovIgL.exe
  2⤵
  PID:14264
- C:\Windows\System\aRBtDoj.exe
  C:\Windows\System\aRBtDoj.exe
  2⤵
  PID:14308
- C:\Windows\System\HBJEIXn.exe
  C:\Windows\System\HBJEIXn.exe
  2⤵
  PID:14324
- C:\Windows\System\gzljpap.exe
  C:\Windows\System\gzljpap.exe
  2⤵
  PID:1080
- C:\Windows\System\auwkHwE.exe
  C:\Windows\System\auwkHwE.exe
  2⤵
  PID:13396
- C:\Windows\System\MeUqTSV.exe
  C:\Windows\System\MeUqTSV.exe
  2⤵
  PID:13348
- C:\Windows\System\veoQQts.exe
  C:\Windows\System\veoQQts.exe
  2⤵
  PID:13548
- C:\Windows\System\uLmxxVe.exe
  C:\Windows\System\uLmxxVe.exe
  2⤵
  PID:13580
- C:\Windows\System\hEMZeTD.exe
  C:\Windows\System\hEMZeTD.exe
  2⤵
  PID:13740
- C:\Windows\System\vztybtp.exe
  C:\Windows\System\vztybtp.exe
  2⤵
  PID:13776
- C:\Windows\System\nbSqixt.exe
  C:\Windows\System\nbSqixt.exe
  2⤵
  PID:13816
- C:\Windows\System\cxfzjxz.exe
  C:\Windows\System\cxfzjxz.exe
  2⤵
  PID:14040
- C:\Windows\System\xEoTEfS.exe
  C:\Windows\System\xEoTEfS.exe
  2⤵
  PID:13968
- C:\Windows\System\iiCECiP.exe
  C:\Windows\System\iiCECiP.exe
  2⤵
  PID:14064
- C:\Windows\System\bapNaUU.exe
  C:\Windows\System\bapNaUU.exe
  2⤵
  PID:14124
- C:\Windows\System\mbOLATZ.exe
  C:\Windows\System\mbOLATZ.exe
  2⤵
  PID:14252
- C:\Windows\System\eqoghUo.exe
  C:\Windows\System\eqoghUo.exe
  2⤵
  PID:14332
- C:\Windows\System\XUnAbBn.exe
  C:\Windows\System\XUnAbBn.exe
  2⤵
  PID:13360
- C:\Windows\System\XaHhIOh.exe
  C:\Windows\System\XaHhIOh.exe
  2⤵
  PID:13640
- C:\Windows\System\EWNmDFj.exe
  C:\Windows\System\EWNmDFj.exe
  2⤵
  PID:13648
- C:\Windows\System\wjUpqeC.exe
  C:\Windows\System\wjUpqeC.exe
  2⤵
  PID:13996
- C:\Windows\System\zTBklwt.exe
  C:\Windows\System\zTBklwt.exe
  2⤵
  PID:3352
- C:\Windows\System\ZDpsZxR.exe
  C:\Windows\System\ZDpsZxR.exe
  2⤵
  PID:14188
- C:\Windows\System\JNAMjmX.exe
  C:\Windows\System\JNAMjmX.exe
  2⤵
  PID:13336
- C:\Windows\System\JqZAdlT.exe
  C:\Windows\System\JqZAdlT.exe
  2⤵
  PID:13760
- C:\Windows\System\aeHCupI.exe
  C:\Windows\System\aeHCupI.exe
  2⤵
  PID:13952
- C:\Windows\System\ZHBeOoq.exe
  C:\Windows\System\ZHBeOoq.exe
  2⤵
  PID:14340
- C:\Windows\System\QvBMErA.exe
  C:\Windows\System\QvBMErA.exe
  2⤵
  PID:14356
- C:\Windows\System\FRuchnt.exe
  C:\Windows\System\FRuchnt.exe
  2⤵
  PID:14384
- C:\Windows\System\lNahvWy.exe
  C:\Windows\System\lNahvWy.exe
  2⤵
  PID:14400
- C:\Windows\System\hRDjoKx.exe
  C:\Windows\System\hRDjoKx.exe
  2⤵
  PID:14424
- C:\Windows\System\LgDBWIA.exe
  C:\Windows\System\LgDBWIA.exe
  2⤵
  PID:14444
- C:\Windows\System\edcYGFL.exe
  C:\Windows\System\edcYGFL.exe
  2⤵
  PID:14460
- C:\Windows\System\eCVgXnr.exe
  C:\Windows\System\eCVgXnr.exe
  2⤵
  PID:14508
- C:\Windows\System\MrfOcDS.exe
  C:\Windows\System\MrfOcDS.exe
  2⤵
  PID:14532
- C:\Windows\System\aPLoWAf.exe
  C:\Windows\System\aPLoWAf.exe
  2⤵
  PID:14548
- C:\Windows\System\yVMLvYr.exe
  C:\Windows\System\yVMLvYr.exe
  2⤵
  PID:14572
- C:\Windows\System\pXCtZHn.exe
  C:\Windows\System\pXCtZHn.exe
  2⤵
  PID:14596
- C:\Windows\System\wqssXMv.exe
  C:\Windows\System\wqssXMv.exe
  2⤵
  PID:14620
- C:\Windows\System\WKjFUdm.exe
  C:\Windows\System\WKjFUdm.exe
  2⤵
  PID:14640
- C:\Windows\System\muhIAea.exe
  C:\Windows\System\muhIAea.exe
  2⤵
  PID:14664
- C:\Windows\System\GOWYLVQ.exe
  C:\Windows\System\GOWYLVQ.exe
  2⤵
  PID:14684
- C:\Windows\System\KknARkK.exe
  C:\Windows\System\KknARkK.exe
  2⤵
  PID:14712
- C:\Windows\System\KMReKUv.exe
  C:\Windows\System\KMReKUv.exe
  2⤵
  PID:14732
- C:\Windows\System\tUqbbPL.exe
  C:\Windows\System\tUqbbPL.exe
  2⤵
  PID:14752
- C:\Windows\System\nKflnqM.exe
  C:\Windows\System\nKflnqM.exe
  2⤵
  PID:14772
- C:\Windows\System\sHbodGn.exe
  C:\Windows\System\sHbodGn.exe
  2⤵
  PID:14796
- C:\Windows\System\jNAmbjU.exe
  C:\Windows\System\jNAmbjU.exe
  2⤵
  PID:14824
- C:\Windows\System\Ojhzakk.exe
  C:\Windows\System\Ojhzakk.exe
  2⤵
  PID:14840
- C:\Windows\System\spCVecO.exe
  C:\Windows\System\spCVecO.exe
  2⤵
  PID:14860
- C:\Windows\System\TiTkmVd.exe
  C:\Windows\System\TiTkmVd.exe
  2⤵
  PID:14888
- C:\Windows\System\HbXAOzB.exe
  C:\Windows\System\HbXAOzB.exe
  2⤵
  PID:14908
- C:\Windows\System\JWOwlHf.exe
  C:\Windows\System\JWOwlHf.exe
  2⤵
  PID:14936
- C:\Windows\System\wzjuFoj.exe
  C:\Windows\System\wzjuFoj.exe
  2⤵
  PID:15000
- C:\Windows\System\ZRbLljF.exe
  C:\Windows\System\ZRbLljF.exe
  2⤵
  PID:15016
- C:\Windows\System\RzOknPa.exe
  C:\Windows\System\RzOknPa.exe
  2⤵
  PID:15036
- C:\Windows\System\uCwrELf.exe
  C:\Windows\System\uCwrELf.exe
  2⤵
  PID:15064
- C:\Windows\System\KLHYMmK.exe
  C:\Windows\System\KLHYMmK.exe
  2⤵
  PID:15092
- C:\Windows\System\CrIDNvg.exe
  C:\Windows\System\CrIDNvg.exe
  2⤵
  PID:15112
- C:\Windows\System\ibJVYeW.exe
  C:\Windows\System\ibJVYeW.exe
  2⤵
  PID:15132
- C:\Windows\System\ORxZuge.exe
  C:\Windows\System\ORxZuge.exe
  2⤵
  PID:15172
- C:\Windows\System\YbtDzJp.exe
  C:\Windows\System\YbtDzJp.exe
  2⤵
  PID:15200
- C:\Windows\System\PkMRRBK.exe
  C:\Windows\System\PkMRRBK.exe
  2⤵
  PID:15220
- C:\Windows\System\tJiiTvY.exe
  C:\Windows\System\tJiiTvY.exe
  2⤵
  PID:15252
- C:\Windows\System\qzuNkOU.exe
  C:\Windows\System\qzuNkOU.exe
  2⤵
  PID:15300
- C:\Windows\System\vGexEHw.exe
  C:\Windows\System\vGexEHw.exe
  2⤵
  PID:15332
- C:\Windows\System\dQFXNHf.exe
  C:\Windows\System\dQFXNHf.exe
  2⤵
  PID:15348
- C:\Windows\System\bBpJdwE.exe
  C:\Windows\System\bBpJdwE.exe
  2⤵
  PID:1044
- C:\Windows\System\bqeLmWe.exe
  C:\Windows\System\bqeLmWe.exe
  2⤵
  PID:13956
- C:\Windows\System\OJwoJto.exe
  C:\Windows\System\OJwoJto.exe
  2⤵
  PID:14440
- C:\Windows\System\bRiOuDD.exe
  C:\Windows\System\bRiOuDD.exe
  2⤵
  PID:14516
- C:\Windows\System\TJyhmDi.exe
  C:\Windows\System\TJyhmDi.exe
  2⤵
  PID:14436
- C:\Windows\System\fJiYfbo.exe
  C:\Windows\System\fJiYfbo.exe
  2⤵
  PID:14456
- C:\Windows\System\hnnZyoH.exe
  C:\Windows\System\hnnZyoH.exe
  2⤵
  PID:14588
- C:\Windows\System\bbWDqOk.exe
  C:\Windows\System\bbWDqOk.exe
  2⤵
  PID:14612
- C:\Windows\System\JyBKLRQ.exe
  C:\Windows\System\JyBKLRQ.exe
  2⤵
  PID:14724
- C:\Windows\System\gjIerfd.exe
  C:\Windows\System\gjIerfd.exe
  2⤵
  PID:14652
- C:\Windows\System\zJkIiCM.exe
  C:\Windows\System\zJkIiCM.exe
  2⤵
  PID:14676
- C:\Windows\System\lKagbyd.exe
  C:\Windows\System\lKagbyd.exe
  2⤵
  PID:14696
- C:\Windows\System\ytsFzJZ.exe
  C:\Windows\System\ytsFzJZ.exe
  2⤵
  PID:14744
- C:\Windows\System\DieGWcL.exe
  C:\Windows\System\DieGWcL.exe
  2⤵
  PID:15012
- C:\Windows\System\EggyimU.exe
  C:\Windows\System\EggyimU.exe
  2⤵
  PID:14868
- C:\Windows\System\YzNAhJZ.exe
  C:\Windows\System\YzNAhJZ.exe
  2⤵
  PID:14900
- C:\Windows\System\rwGNORW.exe
  C:\Windows\System\rwGNORW.exe
  2⤵
  PID:15044
- C:\Windows\System\Hmtieri.exe
  C:\Windows\System\Hmtieri.exe
  2⤵
  PID:14980
- C:\Windows\System\rdcUBPe.exe
  C:\Windows\System\rdcUBPe.exe
  2⤵
  PID:15120
- C:\Windows\System\VoRTaKv.exe
  C:\Windows\System\VoRTaKv.exe
  2⤵
  PID:15088
- C:\Windows\System\foOpNWH.exe
  C:\Windows\System\foOpNWH.exe
  2⤵
  PID:13148
- C:\Windows\System\rhsNqdn.exe
  C:\Windows\System\rhsNqdn.exe
  2⤵
  PID:13440
- C:\Windows\System\YUBOXdp.exe
  C:\Windows\System\YUBOXdp.exe
  2⤵
  PID:15160
- C:\Windows\System\bwvsGzo.exe
  C:\Windows\System\bwvsGzo.exe
  2⤵
  PID:15324
- C:\Windows\System\vTxSQiV.exe
  C:\Windows\System\vTxSQiV.exe
  2⤵
  PID:15340
- C:\Windows\System\UzWqGLS.exe
  C:\Windows\System\UzWqGLS.exe
  2⤵
  PID:14880
- C:\Windows\System\MKCePFw.exe
  C:\Windows\System\MKCePFw.exe
  2⤵
  PID:15384
- C:\Windows\System\rekGHik.exe
  C:\Windows\System\rekGHik.exe
  2⤵
  PID:15404
- C:\Windows\System\aZsVOeD.exe
  C:\Windows\System\aZsVOeD.exe
  2⤵
  PID:15444
- C:\Windows\System\AkHpbNr.exe
  C:\Windows\System\AkHpbNr.exe
  2⤵
  PID:15468
- C:\Windows\System\hWFBsSG.exe
  C:\Windows\System\hWFBsSG.exe
  2⤵
  PID:15572
- C:\Windows\System\RHypTSx.exe
  C:\Windows\System\RHypTSx.exe
  2⤵
  PID:15624
- C:\Windows\System\spTKqaH.exe
  C:\Windows\System\spTKqaH.exe
  2⤵
  PID:15652
- C:\Windows\System\mFDcaib.exe
  C:\Windows\System\mFDcaib.exe
  2⤵
  PID:15668
- C:\Windows\System\CebRYLk.exe
  C:\Windows\System\CebRYLk.exe
  2⤵
  PID:15692
- C:\Windows\System\vceTAqi.exe
  C:\Windows\System\vceTAqi.exe
  2⤵
  PID:15708
- C:\Windows\System\chqRYqd.exe
  C:\Windows\System\chqRYqd.exe
  2⤵
  PID:15732
- C:\Windows\System\nRnRdHo.exe
  C:\Windows\System\nRnRdHo.exe
  2⤵
  PID:15752
- C:\Windows\System\NzibwdR.exe
  C:\Windows\System\NzibwdR.exe
  2⤵
  PID:15796
- C:\Windows\System\TMPwGCf.exe
  C:\Windows\System\TMPwGCf.exe
  2⤵
  PID:15812
- C:\Windows\System\AaBkjhL.exe
  C:\Windows\System\AaBkjhL.exe
  2⤵
  PID:15836
- C:\Windows\System\vJVitiZ.exe
  C:\Windows\System\vJVitiZ.exe
  2⤵
  PID:15852
- C:\Windows\System\ejASWRF.exe
  C:\Windows\System\ejASWRF.exe
  2⤵
  PID:15872
- C:\Windows\System\bLOFUmO.exe
  C:\Windows\System\bLOFUmO.exe
  2⤵
  PID:15888
- C:\Windows\System\Ajmajyb.exe
  C:\Windows\System\Ajmajyb.exe
  2⤵
  PID:15908
- C:\Windows\System\EPTQaGO.exe
  C:\Windows\System\EPTQaGO.exe
  2⤵
  PID:15924
- C:\Windows\System\QgHgVtb.exe
  C:\Windows\System\QgHgVtb.exe
  2⤵
  PID:15940
- C:\Windows\System\FEIcySY.exe
  C:\Windows\System\FEIcySY.exe
  2⤵
  PID:15960
- C:\Windows\System\FDsYaDU.exe
  C:\Windows\System\FDsYaDU.exe
  2⤵
  PID:15992
- C:\Windows\System\BCIsqpR.exe
  C:\Windows\System\BCIsqpR.exe
  2⤵
  PID:16032
- C:\Windows\System\gFnwSYW.exe
  C:\Windows\System\gFnwSYW.exe
  2⤵
  PID:16052
- C:\Windows\System\wpSkVPc.exe
  C:\Windows\System\wpSkVPc.exe
  2⤵
  PID:16080
- C:\Windows\System\RUaVslq.exe
  C:\Windows\System\RUaVslq.exe
  2⤵
  PID:16108
- C:\Windows\System\rzmNYmE.exe
  C:\Windows\System\rzmNYmE.exe
  2⤵
  PID:16136
- C:\Windows\System\ACinbUt.exe
  C:\Windows\System\ACinbUt.exe
  2⤵
  PID:16164
- C:\Windows\System\UkWjJbc.exe
  C:\Windows\System\UkWjJbc.exe
  2⤵
  PID:16180
- C:\Windows\System\psbCxIO.exe
  C:\Windows\System\psbCxIO.exe
  2⤵
  PID:16204
- C:\Windows\System\suQgbQP.exe
  C:\Windows\System\suQgbQP.exe
  2⤵
  PID:16224
- C:\Windows\System\xOoVmGS.exe
  C:\Windows\System\xOoVmGS.exe
  2⤵
  PID:16240
- C:\Windows\System\VZDTOXz.exe
  C:\Windows\System\VZDTOXz.exe
  2⤵
  PID:16256
- C:\Windows\System\gKHYMis.exe
  C:\Windows\System\gKHYMis.exe
  2⤵
  PID:16280
- C:\Windows\System\hSOAEQC.exe
  C:\Windows\System\hSOAEQC.exe
  2⤵
  PID:16296
- C:\Windows\System\hteUkYj.exe
  C:\Windows\System\hteUkYj.exe
  2⤵
  PID:16312
- C:\Windows\System\LSuGzdp.exe
  C:\Windows\System\LSuGzdp.exe
  2⤵
  PID:16344
- C:\Windows\System\UGdFBZN.exe
  C:\Windows\System\UGdFBZN.exe
  2⤵
  PID:16368
- C:\Windows\System\bWijbFw.exe
  C:\Windows\System\bWijbFw.exe
  2⤵
  PID:15024
- C:\Windows\System\TnmiCWr.exe
  C:\Windows\System\TnmiCWr.exe
  2⤵
  PID:14768
- C:\Windows\System\IGgbPUH.exe
  C:\Windows\System\IGgbPUH.exe
  2⤵
  PID:14392
- C:\Windows\System\HyXlWag.exe
  C:\Windows\System\HyXlWag.exe
  2⤵
  PID:14432
- C:\Windows\System\CrIWVMK.exe
  C:\Windows\System\CrIWVMK.exe
  2⤵
  PID:15236
- C:\Windows\System\JidjdNS.exe
  C:\Windows\System\JidjdNS.exe
  2⤵
  PID:14452
- C:\Windows\System\ojbtgVy.exe
  C:\Windows\System\ojbtgVy.exe
  2⤵
  PID:15296
- C:\Windows\System\AcHHvgO.exe
  C:\Windows\System\AcHHvgO.exe
  2⤵
  PID:15436
- C:\Windows\System\INFVYVj.exe
  C:\Windows\System\INFVYVj.exe
  2⤵
  PID:4184
- C:\Windows\System\oYnZLIv.exe
  C:\Windows\System\oYnZLIv.exe
  2⤵
  PID:15792
- C:\Windows\System\FviwMkT.exe
  C:\Windows\System\FviwMkT.exe
  2⤵
  PID:15804
- C:\Windows\System\Tnygkeh.exe
  C:\Windows\System\Tnygkeh.exe
  2⤵
  PID:15660
- C:\Windows\System\aziHwUn.exe
  C:\Windows\System\aziHwUn.exe
  2⤵
  PID:15676
- C:\Windows\System\TxxKinO.exe
  C:\Windows\System\TxxKinO.exe
  2⤵
  PID:15704
- C:\Windows\System\ADosAtc.exe
  C:\Windows\System\ADosAtc.exe
  2⤵
  PID:15952
- C:\Windows\System\siPuBBa.exe
  C:\Windows\System\siPuBBa.exe
  2⤵
  PID:15564
- C:\Windows\System\qBwMhGm.exe
  C:\Windows\System\qBwMhGm.exe
  2⤵
  PID:15620
- C:\Windows\System\faVJkba.exe
  C:\Windows\System\faVJkba.exe
  2⤵
  PID:15844
- C:\Windows\System\XwHqiKa.exe
  C:\Windows\System\XwHqiKa.exe
  2⤵
  PID:16248
- C:\Windows\System\CvlaNkb.exe
  C:\Windows\System\CvlaNkb.exe
  2⤵
  PID:16356
- C:\Windows\System\AdKkbMZ.exe
  C:\Windows\System\AdKkbMZ.exe
  2⤵
  PID:16120
- C:\Windows\System\PESIQgz.exe
  C:\Windows\System\PESIQgz.exe
  2⤵
  PID:16336
- C:\Windows\System\RUFiLEu.exe
  C:\Windows\System\RUFiLEu.exe
  2⤵
  PID:16000
- C:\Windows\System\nZQewmM.exe
  C:\Windows\System\nZQewmM.exe
  2⤵
  PID:16044
- C:\Windows\System\sFTBudX.exe
  C:\Windows\System\sFTBudX.exe
  2⤵
  PID:16096
- C:\Windows\System\DbIwRBY.exe
  C:\Windows\System\DbIwRBY.exe
  2⤵
  PID:16148
- C:\Windows\System\SBwTWuc.exe
  C:\Windows\System\SBwTWuc.exe
  2⤵
  PID:16176
- C:\Windows\System\OaSyYeM.exe
  C:\Windows\System\OaSyYeM.exe
  2⤵
  PID:16220
- C:\Windows\System\NJdwFpj.exe
  C:\Windows\System\NJdwFpj.exe
  2⤵
  PID:16272
- C:\Windows\System\jIBtcPZ.exe
  C:\Windows\System\jIBtcPZ.exe
  2⤵
  PID:15460
- C:\Windows\System\dTVABSr.exe
  C:\Windows\System\dTVABSr.exe
  2⤵
  PID:16392
- C:\Windows\System\XQuUujR.exe
  C:\Windows\System\XQuUujR.exe
  2⤵
  PID:16428
- C:\Windows\System\DFTywyK.exe
  C:\Windows\System\DFTywyK.exe
  2⤵
  PID:16444
- C:\Windows\System\YsRSuxk.exe
  C:\Windows\System\YsRSuxk.exe
  2⤵
  PID:16460
- C:\Windows\System\YnbJSzz.exe
  C:\Windows\System\YnbJSzz.exe
  2⤵
  PID:16476
- C:\Windows\System\XEFZHcz.exe
  C:\Windows\System\XEFZHcz.exe
  2⤵
  PID:16492
- C:\Windows\System\yqwIvPO.exe
  C:\Windows\System\yqwIvPO.exe
  2⤵
  PID:16524
- C:\Windows\System\WjJIpwL.exe
  C:\Windows\System\WjJIpwL.exe
  2⤵
  PID:16560
- C:\Windows\System\zfJUOiO.exe
  C:\Windows\System\zfJUOiO.exe
  2⤵
  PID:16576
- C:\Windows\System\EBdlRCA.exe
  C:\Windows\System\EBdlRCA.exe
  2⤵
  PID:16592
- C:\Windows\System\MRISlLL.exe
  C:\Windows\System\MRISlLL.exe
  2⤵
  PID:16616
- C:\Windows\System\xAmraiw.exe
  C:\Windows\System\xAmraiw.exe
  2⤵
  PID:16640
- C:\Windows\System\kxIxjFy.exe
  C:\Windows\System\kxIxjFy.exe
  2⤵
  PID:16668
- C:\Windows\System\ctdTZbg.exe
  C:\Windows\System\ctdTZbg.exe
  2⤵
  PID:16824
- C:\Windows\System\wltQOgI.exe
  C:\Windows\System\wltQOgI.exe
  2⤵
  PID:16848
- C:\Windows\System\OwDtAiW.exe
  C:\Windows\System\OwDtAiW.exe
  2⤵
  PID:16872
- C:\Windows\System\oKeNJln.exe
  C:\Windows\System\oKeNJln.exe
  2⤵
  PID:16996
- C:\Windows\System\VxnPxLZ.exe
  C:\Windows\System\VxnPxLZ.exe
  2⤵
  PID:17016
- C:\Windows\System\sMrAZgR.exe
  C:\Windows\System\sMrAZgR.exe
  2⤵
  PID:17036
- C:\Windows\System\MaJzFos.exe
  C:\Windows\System\MaJzFos.exe
  2⤵
  PID:17052
- C:\Windows\System\tHUwqPL.exe
  C:\Windows\System\tHUwqPL.exe
  2⤵
  PID:17068
- C:\Windows\System\tdEWvWh.exe
  C:\Windows\System\tdEWvWh.exe
  2⤵
  PID:17084
- C:\Windows\System\yHwaRmy.exe
  C:\Windows\System\yHwaRmy.exe
  2⤵
  PID:17112
- C:\Windows\System\FGVBOFh.exe
  C:\Windows\System\FGVBOFh.exe
  2⤵
  PID:17128
- C:\Windows\System\mIVjwdf.exe
  C:\Windows\System\mIVjwdf.exe
  2⤵
  PID:17164
- C:\Windows\System\reoWPpn.exe
  C:\Windows\System\reoWPpn.exe
  2⤵
  PID:17180
- C:\Windows\System\FSDGxxT.exe
  C:\Windows\System\FSDGxxT.exe
  2⤵
  PID:17200
- C:\Windows\System\aJkLzde.exe
  C:\Windows\System\aJkLzde.exe
  2⤵
  PID:17224
- C:\Windows\System\OdQfDdC.exe
  C:\Windows\System\OdQfDdC.exe
  2⤵
  PID:17248
- C:\Windows\System\LndbPSj.exe
  C:\Windows\System\LndbPSj.exe
  2⤵
  PID:17268
- C:\Windows\System\DQubUyG.exe
  C:\Windows\System\DQubUyG.exe
  2⤵
  PID:17296
- C:\Windows\System\OWpxIuf.exe
  C:\Windows\System\OWpxIuf.exe
  2⤵
  PID:17320
- C:\Windows\System\KEwBQQb.exe
  C:\Windows\System\KEwBQQb.exe
  2⤵
  PID:14416
- C:\Windows\System\KMHPyqf.exe
  C:\Windows\System\KMHPyqf.exe
  2⤵
  PID:15104
- C:\Windows\System\gqCDWSB.exe
  C:\Windows\System\gqCDWSB.exe
  2⤵
  PID:15396
- C:\Windows\System\hdYCZct.exe
  C:\Windows\System\hdYCZct.exe
  2⤵
  PID:15788
- C:\Windows\System\UEwSpds.exe
  C:\Windows\System\UEwSpds.exe
  2⤵
  PID:15648
- C:\Windows\System\AnsSorG.exe
  C:\Windows\System\AnsSorG.exe
  2⤵
  PID:16512
- C:\Windows\System\QzcffQF.exe
  C:\Windows\System\QzcffQF.exe
  2⤵
  PID:4316
- C:\Windows\System\bihbkGv.exe
  C:\Windows\System\bihbkGv.exe
  2⤵
  PID:16568
- C:\Windows\System\tmhMEKH.exe
  C:\Windows\System\tmhMEKH.exe
  2⤵
  PID:16632
- C:\Windows\System\MwroCLl.exe
  C:\Windows\System\MwroCLl.exe
  2⤵
  PID:15848
- C:\Windows\System\MfSdMIt.exe
  C:\Windows\System\MfSdMIt.exe
  2⤵
  PID:16440
- C:\Windows\System\uvGsWDy.exe
  C:\Windows\System\uvGsWDy.exe
  2⤵
  PID:15192
- C:\Windows\System\zURVqAX.exe
  C:\Windows\System\zURVqAX.exe
  2⤵
  PID:16192
- C:\Windows\System\ubiILMc.exe
  C:\Windows\System\ubiILMc.exe
  2⤵
  PID:15716
- C:\Windows\System\FIzDPiY.exe
  C:\Windows\System\FIzDPiY.exe
  2⤵
  PID:16888
- C:\Windows\System\wxbQgEt.exe
  C:\Windows\System\wxbQgEt.exe
  2⤵
  PID:16252
- C:\Windows\System\RoVoVuM.exe
  C:\Windows\System\RoVoVuM.exe
  2⤵
  PID:16424
- C:\Windows\System\yRvjGkf.exe
  C:\Windows\System\yRvjGkf.exe
  2⤵
  PID:2880
- C:\Windows\System\fughpNG.exe
  C:\Windows\System\fughpNG.exe
  2⤵
  PID:16288
- C:\Windows\System\LnYeyrh.exe
  C:\Windows\System\LnYeyrh.exe
  2⤵
  PID:1544
- C:\Windows\System\cPouxnF.exe
  C:\Windows\System\cPouxnF.exe
  2⤵
  PID:16380
- C:\Windows\System\ezFjKfb.exe
  C:\Windows\System\ezFjKfb.exe
  2⤵
  PID:976
- C:\Windows\System\lmiNeVQ.exe
  C:\Windows\System\lmiNeVQ.exe
  2⤵
  PID:16408
- C:\Windows\System\FGGeHxh.exe
  C:\Windows\System\FGGeHxh.exe
  2⤵
  PID:16088
- C:\Windows\System\qLrNKgB.exe
  C:\Windows\System\qLrNKgB.exe
  2⤵
  PID:1272
- C:\Windows\System\GYXlSVS.exe
  C:\Windows\System\GYXlSVS.exe
  2⤵
  PID:17124
- C:\Windows\System\slpVtra.exe
  C:\Windows\System\slpVtra.exe
  2⤵
  PID:16892
- C:\Windows\System\ARdsdmN.exe
  C:\Windows\System\ARdsdmN.exe
  2⤵
  PID:1988
- C:\Windows\System\bhLBpXo.exe
  C:\Windows\System\bhLBpXo.exe
  2⤵
  PID:17044
- C:\Windows\System\urDuwyA.exe
  C:\Windows\System\urDuwyA.exe
  2⤵
  PID:16812
- C:\Windows\System\XJlsrQQ.exe
  C:\Windows\System\XJlsrQQ.exe
  2⤵
  PID:17080
- C:\Windows\System\BoaBFzC.exe
  C:\Windows\System\BoaBFzC.exe
  2⤵
  PID:16636
- C:\Windows\System\jyUMAkq.exe
  C:\Windows\System\jyUMAkq.exe
  2⤵
  PID:11296
- C:\Windows\System\xOeUkxD.exe
  C:\Windows\System\xOeUkxD.exe
  2⤵
  PID:1396
- C:\Windows\System\VdSTcTR.exe
  C:\Windows\System\VdSTcTR.exe
  2⤵
  PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AKpuGGk.exe

Filesize
1.5MB

MD5
6a76076759be469985a66c6d165f0f29

SHA1
2495e0f75a13e00873ad5549eaeb6af31cf8b3dd

SHA256
3c966ee0eda83d0506120e1cb8399bd55a9df46c687de1f71af50e3f572017a1

SHA512
095b683f5ea87b40c625c74afad1c58bac257b2c2fbdb427ce95dd26d09687feb84e1b4e513f1c7a9d87886b25c2db361c3d3d7b161da7a6fdf692e5fbdc92c2

Download Submit
C:\Windows\System\AnlkEgq.exe

Filesize
1.5MB

MD5
c9d5b7c47e94b8ba98ae7a5c2b31a45b

SHA1
5af65af2e2609ab67d11dbb56c7eb0f0b89b43ee

SHA256
f2d579a786d4c964df2affddcd047b0e7835c7e7cb2985494bdddbe5fbe8097a

SHA512
81d85d3aa68fce4f5252bd518eed235a895603765d86138d132c1ac3245600a0f14dd4b41561d6b358e8f80e12118619838d41d374fe78bad4f9d7d4e896674d

Download Submit
C:\Windows\System\BWlEdxk.exe

Filesize
1.5MB

MD5
7adca5bc588c6ad2514280428474cb1a

SHA1
c8cc37205d521af6823e4d837598a90d311c4722

SHA256
ddb7480b82694d29825f67093740f7bacd5012cd1353c593b486620ac27f57ac

SHA512
b0d184cdf171e57e6f75cd3236426a73fba60515c5043b1930b7bf1bbe87b4b69829fd3187cc44c3e55578057cdd810aa9ed2d9ff4944b5869f0ce62c9aebf8f

Download Submit
C:\Windows\System\BeZvlkn.exe

Filesize
1.5MB

MD5
c81c294dfa13baa17fe6c4b648d674cb

SHA1
b262b2b2bd532a3d2b8242453e13781c4edb2f19

SHA256
676ec8dd8bc0cbba50b24e17cb22c4d9d8096f87a7aa0ed88fc871301e148eff

SHA512
7eb922921bb6d38ed0038d4efc0b5ce7529c7d2dc21c8c319aa469995feb01f8b083f2d9bb3b79f1c5d3eaf978e389f25346e4bcabe99feec0aa0d0f3798e482

Download Submit
C:\Windows\System\CLhbUaZ.exe

Filesize
1.5MB

MD5
2522642d8975ad1e3892a76c8ba3ab83

SHA1
cde48643cc17e9c2d6b196d0ac501423c9fbc3e9

SHA256
3b209ca5fec6a27475d5103b0eab7d587247ca3a7490c5b36f633a466db35bb5

SHA512
d94895763ff9372e3d38b8a45d1cab5d016e80a0a81bc1846ad117382261ad042052544f16def171daf86aac39be4f242471c1fdd6a3e2c2e06ea38c6e4335b0

Download Submit
C:\Windows\System\DTVqtJM.exe

Filesize
1.5MB

MD5
c520faada4cc6c4caad92a663e830eb6

SHA1
82849b3f4b0cb360b78f376411d552051431fd74

SHA256
75ddc177e25f8f28b6fb407bcedcbe6c5577b74dbcdf8c8bd13f86494e9233af

SHA512
a9da29d2034ae8e43bc2f9da2a3095d37759dce4b85def7a94016d2735688db844924151dc2afc5f1c5e36430d95a2c8a1ae812e2708dfe46a46f718e2abddc9

Download Submit
C:\Windows\System\DstZfaO.exe

Filesize
1.5MB

MD5
99d2e035ce9b5c7f9493f405ca25a627

SHA1
85f2af0835f189ab71cf5e1956210431c133fc90

SHA256
868ff88b9ab8188c96043f28e54ae2bf23667a67064a5afe0cb9120e79308bdf

SHA512
5f16171ff9b3bc353d8b0152c27d7c5e89bf1f653b0ba71bbc2e86d7ad9f9264c2cc071b72558595c8877f112f7570ac68040e8f76587ee326702a56116f7163

Download Submit
C:\Windows\System\FvBGLSW.exe

Filesize
1.5MB

MD5
417dfdc1cae52a2dd0c8e25cfcba9309

SHA1
1473ca44245db2abe67215348d5f583740c412b0

SHA256
e0f8501fbb0dac99c444a1d1fae00903884f415116fe2ca1dbd473224dbbaa1d

SHA512
a3546de49907383d04c6c206bb18e870dfecbc267d2af8a8a674eca8c117c1e9967477ee8d70ad905d25c9fdf1f8385c009e95c94038764a30b4d0ae283a9d5e

Download Submit
C:\Windows\System\HOqrBqn.exe

Filesize
1.5MB

MD5
dcfce0407cb69b0240ac81b7e659443a

SHA1
2c5d37868c2034b6cfd9bbb5c2b6437c56b02576

SHA256
ab90dfbf0b90f4bfa64bccc37c2b3b3867ce6824d32b236da8254d7953f0ed05

SHA512
a0c02337a58c19107d6ee8dcc09a9e300e48ec8eb11eee939929d39dc3a9c9fc5942b74bd6b697ec6f527de31ed4a6518b85617490b3295e78912a20c1f204fb

Download Submit
C:\Windows\System\HYecQKJ.exe

Filesize
1.5MB

MD5
d88c8a53b99950acc3aac723de220e72

SHA1
bf65129aaf38339c28fd2dcf10353dc25c677556

SHA256
f25cbb5008ea1bb740d8ec0067e34600b20422e7049f981e838957215b1aeaca

SHA512
119bc0eda092f7530b830db723c3bad644260a2d3746250df453c1c74dbf270bea8aeb6228132dc912603f266d6d8f8c5f9adea5602721a612277772670ec5d6

Download Submit
C:\Windows\System\IiiSFkB.exe

Filesize
1.5MB

MD5
387e4f3bd88e53b5abc0d5adb33cb5a1

SHA1
5ce34c285536822290a74b20768d244f4b900d88

SHA256
170c5426bbba45dc9a100badf170836b9ae67506146a02ad41ef347a75bf1301

SHA512
696a86899432ba3d86a61e6c5e68f493604e96deef9ad7703d4e4f37a2333248228b00ee04ba5e8054c0f70904c3b266466e0952aa55c1d717fedd4214e8fe41

Download Submit
C:\Windows\System\NCKDiYi.exe

Filesize
1.5MB

MD5
f64a6f9ac011f7c5c85d8d0874512400

SHA1
539f80f2815cf358743e3dd26dcf110b4515a3f0

SHA256
4b24dbf5d548f702ea97880dd625eb94b414da1ffbbc65d2c5806c968a497e96

SHA512
fdaa803eb9c49ea3c219b1f469aca3c3e7d7cb3f13813d108f3391d941d6991ab0932248dae7bb37352dd23bd18590be72bcec6cf68cc7ef5b9ab802bb931473

Download Submit
C:\Windows\System\NxXASIB.exe

Filesize
1.5MB

MD5
574b2f9838725e97ac74e9a3e46e5f46

SHA1
c887b067bbaa0bd5f3734655fec83130f4724869

SHA256
eafc7fea3aae56a13d1be6c3a0af3090313a481dfba8f9e86decf9e2edb9d912

SHA512
6a06777bfeb719a98c422c8b2ffa2603ba78c9732c806816a6d511c90585cb8642ca6aef43b021125ce11eb7c7c6a5dae7ed5297efaa559f316457edc11fa5c0

Download Submit
C:\Windows\System\PqUROaI.exe

Filesize
1.5MB

MD5
aa56ba261013f19e94e1a6e2e4139397

SHA1
a8877c71a95cdc295566c1c964600de128ed0aa4

SHA256
1520c428a63e35e15b4f2e4e252f4bc5eabdd3a01743a4a54eed92d4556c5cf0

SHA512
fd9e6740ef55043fd9fff431bc05ff7dde80f9be4dd7ee44d0402a56d658cdbab509d648394990fe0a0e7063c92ee3fd234daf4d2b93dd4e2e2c5daed903dbbd

Download Submit
C:\Windows\System\QRCUSYQ.exe

Filesize
1.5MB

MD5
178dd9cc06d6cc317d0017b73fe0d728

SHA1
b9738da5a75879128cce7aa8fd5cda13b96bcfdb

SHA256
384015295b1938856af8ced05223bbe67f849e98be8ca23532728a21d5ad99ab

SHA512
eb3412342540082d9fcbf8dcb9a7166a2bc9a862c31c07f64c09881ad1c99224400ac73278e3b85b20f8a89eade0de97c1fd31284aef2554259f07c7e98f92c7

Download Submit
C:\Windows\System\QkuMPhF.exe

Filesize
1.5MB

MD5
6ab4241c1e3243c6163cf0fa5173351c

SHA1
d5ee68cf213998633d14dc26c521282bb7f6e613

SHA256
2134c5565b4f1fc4fb29336a06ecdf7d222ef48e1cde442b6aa333a2bee58611

SHA512
fe5bbce6fff8ba334d7c39078c19cd4b2d164922164fc92b9a32d1945368e010f66d0434b9a134aafad9de3f496297872f9215c3b54164717c4ef504ee3dd45f

Download Submit
C:\Windows\System\UkajVWN.exe

Filesize
1.5MB

MD5
b0e06597f9612210719c39ad2f79dcc2

SHA1
dfa3fb196cf521fc3ab8dcc8630645fea5ad9cc2

SHA256
dda3074e18022a8d90902bd8c7aaff9fe32f639ec44f3625a9634ab481feb2b7

SHA512
f850889e63404c0ccd9db94021333ab5e3a34c749f7127f69339887f188faa5b877b48e3cd7f2ae9f9ed1a50c96e001d95e33b9da0858480f9ba87608629dbbb

Download Submit
C:\Windows\System\WNCjorU.exe

Filesize
1.5MB

MD5
db6566497785d105ce4bf5f951738e42

SHA1
0e93623cfbc3533be796fae7ee2b27c93d646937

SHA256
9a6f0ef2944a4184c5ba0a897c4e1b9ca2bb4a1e5db21f96598ad73c8baf3bc6

SHA512
22b4421edc6a025c2b10763575237bcd77ed3fd3ed358f098bbf757835bfbc1c8674c86075c00c1a6ff06df271a4f80c28161b92b79790203c34b1af85e8879c

Download Submit
C:\Windows\System\axjqzXJ.exe

Filesize
1.5MB

MD5
cb7cad48248b51ddce78784168f54b7d

SHA1
1fcfa39a10927594030361a41f868d78e4b2bac6

SHA256
8421e8e434d42dca02b1daa500eb0ddd26b81dcb74de1c3b1459860dac482e11

SHA512
9b516384e7c21b9125b2f2ce0e6cebe6d1aae4af5310d4c05701a0afac8b1337ecf5ce8d304e02263652fab3e41044f984c8d689c412fc8dd29db2376a35e2ed

Download Submit
C:\Windows\System\dbDMeuL.exe

Filesize
1.5MB

MD5
74af6113c6927199688ce71a8235e955

SHA1
8bcc2ce3d2d81d14383b0dde8ce3fde03781f1a0

SHA256
c42436703a0eb73acac9698daa4a93dd403ae05848f5252d3449698bc0e05265

SHA512
b1e50a545c44398e26cd537a88ee310419d93f7a0744f0a8cbd5955a82f1e3a132dcb6e17c35ca4def2191034c8cd570a2385d0409c3a96f08db9a93b78367a6

Download Submit
C:\Windows\System\dxjLWLQ.exe

Filesize
1.5MB

MD5
37c4223fe8bd294ad93d01f4b703db34

SHA1
9d7a7653f78275fcbf384d6ad356beafbe800390

SHA256
a8d00aebf5a57bfdbacc68a3887c338c3352d4e361e9ba7a29430a55a983c5a2

SHA512
31ae832fe09e3a795bfb2c958d9112a3c675bc11be0d27a8e916d14655685a905722baa55e2afe427233fd78fe82fd923749ccea2f07a6bd7edf9cee46ef4cc1

Download Submit
C:\Windows\System\faynkne.exe

Filesize
1.5MB

MD5
fc55430c8296caac5e0fa8331cd203d8

SHA1
8f64eb2e151b6eaf481a342037e6e1170140c3ab

SHA256
000988a46f4d5d1613ece6525d29ccde111c31a4ada0875d15ba785985c7d350

SHA512
15615107ac006e156b134164b30c4cb761f83aa82b973e6b4cf351fdd1aec95909aac1b572ff9ea2151cee73f0d3602945f2f97ed00c6dba7f5388e7f1559100

Download Submit
C:\Windows\System\jSBynWe.exe

Filesize
1.5MB

MD5
2217d2d535986827cfa65c26eee73158

SHA1
f8bd7bebf07f69e7a65860a51c866dcfc740a07f

SHA256
a74226e08be63d14dd9c2c5fc2c9c99dcde38c1a6407fc9ce7036bfbbc914c06

SHA512
29ef7ccb0256c30ee18150199e031085d8412b44633f04533486fa511c378c5ce9f4b9b910fefd1a3cd115a52b24b9de0d6f89d0b9581870ccb6b0c9b8abaf7b

Download Submit
C:\Windows\System\ktjXIhk.exe

Filesize
1.5MB

MD5
a945212f259649e70edc9226f8805584

SHA1
1d7b13c10364dfbc51ff48e97a5de75781a2d525

SHA256
31848c29b46c6b728ac2bcba2cb67b5838f41eaa56cbd833f4e07e0a8d68db7b

SHA512
97d665cc6733bccc3341bd83cddc7462fb978d0cd279dbae518be26d1a851eb2a37f32708bd778d34e317221d129ff957e2e1d3c345d6ab130e0e1691d87047f

Download Submit
C:\Windows\System\paIobUs.exe

Filesize
1.5MB

MD5
c08ee125229bc9cdb8aa387ba0754e09

SHA1
28d2d47683cfcbd6e5265927742d346241c754e6

SHA256
4f8b423008d31fcda02a883d380601ea0590506bc53a9efa51decf02a74407c1

SHA512
a599c2c388878567f29258189f7e28617ea84f7831ccaae03cff406aa3a78d36a449fdc7ba2563ee7d10ff786a4025546f8920c986286025ec5dc15346c1ce1a

Download Submit
C:\Windows\System\rZpwurr.exe

Filesize
1.5MB

MD5
f1282598ab9f4b0b832d64fe51cfc72a

SHA1
800b9b3efd6f11a1e1033d99a9e63895ea05e289

SHA256
2995a4bc395f6f81faa8048d62cafa8b6cde3d8b957acd7d7e4cded9aabd2ac0

SHA512
6345a1897b93561f3e1f16fcbafb0c3222b5625e74f6d6a5e9e4bb45472ecb0434e83e84e4745121b6809c603d3aa188edbe8d8ac59dae29ff664ce9c0598598

Download Submit
C:\Windows\System\rlJMOjg.exe

Filesize
1.5MB

MD5
5606ac56f6bd7fdc6d2d21b17f35daae

SHA1
5e52c9a6d7b2fb39e640c700e587478addf6cf97

SHA256
65cb372f68200c96fa439011f43d857e511b23b28f68ed15da1828f454f2030f

SHA512
b334781bf039cddb2116f0d7ac30e89801c0c207ac2a05655e6cdc0d1d750b0cb09e854cba138c3dbba6f6294dfcc385201f0ffe8c0355f46ab1bd0fd77e4a87

Download Submit
C:\Windows\System\spUSFmZ.exe

Filesize
1.5MB

MD5
4a0a4aa9e6c6062fddd9617fc6af4cc6

SHA1
da5f46e80a70fe13fc156891ea042d10bf6ae963

SHA256
8ad47ec1d958f2406948f0e2bfcdb2ebd692cdb1ab9509bf272fffb29fb21f64

SHA512
d04c38cd43f6ea5be7915f9471ca100f19ffe9893efff3ee61fe7c621d592e1efebef19364f9536011e9db51f8fd79fb6983a41861f19ed23622dd56d741dcab

Download Submit
C:\Windows\System\srxehNd.exe

Filesize
1.5MB

MD5
7790e55ec951af2ca200ca8e5959d3fd

SHA1
8f8bf7fc271f0dc0c31e1b6b3f006a659e18c38e

SHA256
5d093b7a4ee6fdab4eeff19646701ecd92dddc92ad930f71059eac9f95998f35

SHA512
44ad7080475b0b9ba153458c0ea8d27c73681664417903e4fff76d30f83faa91510866bd7b02ecc1788b85545ed046002262c5a535bfeaf12955180355800acb

Download Submit
C:\Windows\System\uBYxtJb.exe

Filesize
1.5MB

MD5
05273df5f909b6c7c4d3b504d1d44f05

SHA1
ff2a51701ff6c52431dcb0501d9aac3edaeb004b

SHA256
ac53263bcf554d1f48e214845671dc6182b5a26dbbd07ff38b548f60021bb238

SHA512
7e90c729d414f27456efe07d6a1b25e1933af0b9ee6d3c0660f5324bba51b6157df7444c0c7b0fa5c263dda414c69a74ec70b88193bb2942a02c286939b3a378

Download Submit
C:\Windows\System\vFmNePA.exe

Filesize
1.5MB

MD5
4a1d33d7e12b2deed9786aab1ec5a493

SHA1
06744672584293e7106d151fb2782c7d1bcb3b55

SHA256
797d41440c9950b10d42ed86626f7f8618e961c5dc8ff0531dd9ef58f099973c

SHA512
fc958323f3ccbefce938c7a8d76d280f3e9ce99116a5c3f089197cf181a93918b27679fc5cea6dbcfdbb49f7b3a394fde3948ad930331717666b0f875854a0c2

Download Submit
C:\Windows\System\wSjFjAY.exe

Filesize
1.5MB

MD5
cb590216de25e5b0336adff31dbb5e16

SHA1
1ea6b907560e68f33ed64e0858d18620f64a4496

SHA256
9ec283fca668bd15f5187c17a4437576137af9950f3f54181ce6dc9b444fdd5a

SHA512
4f52b60bbb948d7f006685f2b9c6091d56cf7712e41eaffa506dd051eb0a0b197e2d503481592401b255ff00456c70356b396b8ef6f53a405db6897b187926fa

Download Submit
C:\Windows\System\zavbAsg.exe

Filesize
1.5MB

MD5
ae76c08a3260a9a1e05be75275b688f0

SHA1
fb6e2c96e439284a554846e57807d2f2f246fbca

SHA256
041bb2b4db68ded2f33ae568ddf398df8b4fe77bb207656255fa1256b9fbb183

SHA512
b5ce1399aef672db1b52eb0135ace899ab96caf9ffac75560f81d5d818adf7a75e8d40bec9e70e5eefccdbea1fb9fa3b9aadd8e9309b05cddb3fbad1a3f562c5

Download Submit
memory/720-0-0x00000166D6480000-0x00000166D6490000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads